Edit tour

Windows Analysis Report
UGcjMkPWwW.exe

Overview

General Information

Sample name:	UGcjMkPWwW.exe renamed because original name is a hash value
Original sample name:	14988e9d35a0c92435297f7b2821dc60.exe
Analysis ID:	1542681
MD5:	14988e9d35a0c92435297f7b2821dc60
SHA1:	8c00da2ab4cf6da0c179f283eac0053231859f8c
SHA256:	677b8ff45ebb9486a99aecf8dd2b4b362010573ecc4d0d082eda6a36a7cab671
Tags:	32exetrojan
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RHADAMANTHYS Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Dllhost Internet Connection

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

UGcjMkPWwW.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\UGcjMkPWwW.exe" MD5: 14988E9D35A0C92435297F7B2821DC60)

OpenWith.exe (PID: 7316 cmdline: "C:\Windows\system32\openwith.exe" MD5: 0ED31792A7FFF811883F80047CBCFC91)

OpenWith.exe (PID: 7404 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

wmlaunch.exe (PID: 7720 cmdline: "C:\Program Files\Windows Media Player\wmlaunch.exe" MD5: 836F3636C231980EAD81C84BCA55D82B)

dllhost.exe (PID: 7760 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/ https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
UGcjMkPWwW.exe	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000001.00000003.1743648406.0000000000C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000000.1707524321.00000000003D1000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000001.00000003.1768649425.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1745436761.0000000005180000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.1903745557.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.1740844173.00000000003C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1742866792.0000000003E20000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000002.1827092674.00000000046E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.1743471717.00000000032C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: UGcjMkPWwW.exe PID: 7256	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 7316	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 7404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.UGcjMkPWwW.exe.3d0000.0.unpack	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0.2.UGcjMkPWwW.exe.3d0000.0.unpack	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
1.3.OpenWith.exe.5180000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.UGcjMkPWwW.exe.3c00000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.3.OpenWith.exe.5180000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.UGcjMkPWwW.exe.3e20000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.UGcjMkPWwW.exe.3c00000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.3.OpenWith.exe.4f60000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.UGcjMkPWwW.exe.3c00000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 4 entries

Sigma Signatures

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 193.149.185.109, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\dllhost.exe, Initiated: true, ProcessId: 7760, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739

Suricata Signatures

ETPRO JA3 HASH Suspected Malware Related Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:08:23.216587+0200	2854824	2	Potentially Bad Traffic	185.196.11.237	9697	192.168.2.4	49735	TCP
2024-10-26T07:08:33.165194+0200	2854824	2	Potentially Bad Traffic	185.196.11.237	9697	192.168.2.4	49738	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:08:09.613244+0200	2854802	1	Domain Observed Used for C2 Detected	185.196.11.237	9697	192.168.2.4	49730	TCP
2024-10-26T07:08:23.216587+0200	2854802	1	Domain Observed Used for C2 Detected	185.196.11.237	9697	192.168.2.4	49735	TCP
2024-10-26T07:08:33.165194+0200	2854802	1	Domain Observed Used for C2 Detected	185.196.11.237	9697	192.168.2.4	49738	TCP
2024-10-26T07:08:39.290556+0200	2854802	1	Domain Observed Used for C2 Detected	193.149.185.109	443	192.168.2.4	49739	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: UGcjMkPWwW.exe

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr"}

Multi AV Scanner detection for domain / URL

Source: https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for submitted file

Source: UGcjMkPWwW.exe	ReversingLabs: Detection: 65%
Source: UGcjMkPWwW.exe	Virustotal: Detection: 82%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: UGcjMkPWwW.exe

Joe Sandbox ML: detected

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF401542258 CryptUnprotectData,

2_3_00007DF401542258

Source: UGcjMkPWwW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 193.149.185.109:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: UGcjMkPWwW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1742498648.0000000003C80000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742437180.0000000000550000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745057785.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745121603.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742866792.0000000003E20000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745436761.0000000005180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb!8 source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1741895197.0000000003DF0000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1741747932.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744570517.0000000005150000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744423678.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1742108870.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742251026.0000000003DA0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744926026.0000000005100000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744787920.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1741895197.0000000003DF0000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1741747932.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744570517.0000000005150000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744423678.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1742108870.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742251026.0000000003DA0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744926026.0000000005100000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744787920.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831H source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmlaunch.exe, wmlaunch.exe, 00000006.00000003.2031195643.000001E4D5B30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000006.00000003.2031233133.000001E4D5B60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742866792.0000000003E20000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745436761.0000000005180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1742498648.0000000003C80000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742437180.0000000000550000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745057785.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745121603.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmlaunch.exe, 00000006.00000003.2031195643.000001E4D5B30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000006.00000003.2031233133.000001E4D5B60000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	2_3_00007DF40154E261
Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	2_2_00000251D3090511
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 4x nop then dec esp	6_2_000001E4D5865641

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 185.196.11.237:9697 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 185.196.11.237:9697 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 185.196.11.237:9697 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 193.149.185.109:443 -> 192.168.2.4:49739

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.196.11.237:9697

Source: Joe Sandbox View	ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH
Source: Joe Sandbox View	ASN Name: DANISCODK DANISCODK

Source: Joe Sandbox View

JA3 fingerprint: caec7ddf6889590d999d7ca1b76373b6

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 185.196.11.237:9697 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 185.196.11.237:9697 -> 192.168.2.4:49738

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.11.237

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF401574520 WSARecv,

2_3_00007DF401574520

Source: OpenWith.exe, OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066579486.00000251D50BB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116558649.00000251D5171000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2118106280.00000251D5363000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1897761721.00000251D5158000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934539814.00000251D5172000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1939343716.00000251D5172000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1897605961.00000251D5158000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1877587550.00000251D5158000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D5158000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116279598.00000251D535B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr
Source: OpenWith.exe, 00000001.00000002.1826825865.0000000000ABC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr(
Source: wmlaunch.exe, 00000006.00000002.2963426023.000001E4D5C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1frV
Source: OpenWith.exe, 00000001.00000003.1826414618.000000000534A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1frkernelbasentdllkernel32GetProcessMitigationP
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: OpenWith.exe, 00000002.00000003.1907438108.00000251D568E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: OpenWith.exe, 00000002.00000003.1907438108.00000251D568E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2118049130.00000251D5189000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1908124915.00000251D5186000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058668514.00000251D5186000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1939089748.00000251D5186000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066984941.00000251D5189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mic
Source: OpenWith.exe, 00000002.00000003.1907554669.00000251D50DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: OpenWith.exe, 00000002.00000003.1900403681.00000251D561B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: OpenWith.exe, 00000002.00000003.1907554669.00000251D50DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117778749.00000251D50BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: OpenWith.exe, 00000002.00000003.1900403681.00000251D561B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t.mc_id=EnterPK201694ba2e0b-6
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 193.149.185.109:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: UGcjMkPWwW.exe, 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_1aaee10a-c

Source: UGcjMkPWwW.exe, 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_4915282c-b

Source: Yara match	File source: 1.3.OpenWith.exe.5180000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UGcjMkPWwW.exe.3c00000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.OpenWith.exe.5180000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UGcjMkPWwW.exe.3e20000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UGcjMkPWwW.exe.3c00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.OpenWith.exe.4f60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UGcjMkPWwW.exe.3c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1745436761.0000000005180000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1742866792.0000000003E20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UGcjMkPWwW.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 7316, type: MEMORYSTR

Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D31030C7 NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,RtlFreeHeap,RtlFreeHeap,	2_3_00000251D31030C7
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154C10C NtAcceptConnectPort,	2_3_00007DF40154C10C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154D2F4 NtAcceptConnectPort,NtAcceptConnectPort,	2_3_00007DF40154D2F4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154B498 NtAcceptConnectPort,calloc,DuplicateHandle,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,	2_3_00007DF40154B498
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154C47C NtAcceptConnectPort,	2_3_00007DF40154C47C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154D3C0 NtAcceptConnectPort,NtAcceptConnectPort,	2_3_00007DF40154D3C0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154C70C NtAcceptConnectPort,	2_3_00007DF40154C70C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154C7CC NtAcceptConnectPort,	2_3_00007DF40154C7CC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154ACE8 NtAcceptConnectPort,	2_3_00007DF40154ACE8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154BCC0 NtAcceptConnectPort,NtAcceptConnectPort,free,	2_3_00007DF40154BCC0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154ACC8 NtAcceptConnectPort,	2_3_00007DF40154ACC8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154AD14 NtAcceptConnectPort,	2_3_00007DF40154AD14
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154AC0C NtAcceptConnectPort,	2_3_00007DF40154AC0C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154AF60 NtAcceptConnectPort,	2_3_00007DF40154AF60
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154AF40 NtAcceptConnectPort,	2_3_00007DF40154AF40
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154ADD4 NtAcceptConnectPort,	2_3_00007DF40154ADD4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154AE5C NtAcceptConnectPort,	2_3_00007DF40154AE5C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154BE6C calloc,NtAcceptConnectPort,	2_3_00007DF40154BE6C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_00000251D3091A90 NtAcceptConnectPort,NtAcceptConnectPort,	2_2_00000251D3091A90
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_00000251D3090AC8 NtAcceptConnectPort,NtAcceptConnectPort,	2_2_00000251D3090AC8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_00000251D30915AC NtAcceptConnectPort,	2_2_00000251D30915AC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_00000251D3091CD0 NtAcceptConnectPort,CloseHandle,	2_2_00000251D3091CD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_3_00007DF4E2E91958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	6_3_00007DF4E2E91958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_3_00007DF4E2E91CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	6_3_00007DF4E2E91CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5872990 NtAcceptConnectPort,	6_2_000001E4D5872990
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58729D4 NtAcceptConnectPort,	6_2_000001E4D58729D4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587252C NtAcceptConnectPort,	6_2_000001E4D587252C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5872C64 NtAcceptConnectPort,	6_2_000001E4D5872C64
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5872418 NtAcceptConnectPort,	6_2_000001E4D5872418
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58728E8 NtAcceptConnectPort,	6_2_000001E4D58728E8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587288C NtAcceptConnectPort,	6_2_000001E4D587288C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58728B8 NtAcceptConnectPort,	6_2_000001E4D58728B8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58727B8 NtAcceptConnectPort,	6_2_000001E4D58727B8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2E92704 NtQuerySystemInformation,malloc,NtQuerySystemInformation,	6_2_00007DF4E2E92704
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2E91A50 NtQueryInformationProcess,	6_2_00007DF4E2E91A50
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2E91A08 NtAllocateVirtualMemory,	6_2_00007DF4E2E91A08
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2E91B3C NtReadVirtualMemory,	6_2_00007DF4E2E91B3C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2E91ABC NtReadVirtualMemory,	6_2_00007DF4E2E91ABC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2E91B7C NtReadVirtualMemory,	6_2_00007DF4E2E91B7C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2E91D18 NtReadVirtualMemory,	6_2_00007DF4E2E91D18
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A3385C NtQuerySystemInformation,	7_2_000002D392A3385C

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_00430BC1	0_2_00430BC1
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D3104A38	2_3_00000251D3104A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D3102C3C	2_3_00000251D3102C3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D31024F7	2_3_00000251D31024F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D3105E7C	2_3_00000251D3105E7C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D310557C	2_3_00000251D310557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D31058FC	2_3_00000251D31058FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D3101BA6	2_3_00000251D3101BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00000251D310279C	2_3_00000251D310279C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40157B104	2_3_00007DF40157B104
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401522634	2_3_00007DF401522634
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015920BC	2_3_00007DF4015920BC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015EA168	2_3_00007DF4015EA168
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40159CFB4	2_3_00007DF40159CFB4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40161BFCC	2_3_00007DF40161BFCC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40160AF80	2_3_00007DF40160AF80
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401521058	2_3_00007DF401521058
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40156F02C	2_3_00007DF40156F02C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4016172C8	2_3_00007DF4016172C8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40160B318	2_3_00007DF40160B318
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015BE24C	2_3_00007DF4015BE24C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40160A4A0	2_3_00007DF40160A4A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401608474	2_3_00007DF401608474
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401572524	2_3_00007DF401572524
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015FA3D4	2_3_00007DF4015FA3D4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40156F3B8	2_3_00007DF40156F3B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40157A430	2_3_00007DF40157A430
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015643F8	2_3_00007DF4015643F8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015893F4	2_3_00007DF4015893F4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015896E0	2_3_00007DF4015896E0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015775E4	2_3_00007DF4015775E4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015895D0	2_3_00007DF4015895D0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40157D594	2_3_00007DF40157D594
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40152F624	2_3_00007DF40152F624
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40160A8BC	2_3_00007DF40160A8BC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40153F95C	2_3_00007DF40153F95C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40154996C	2_3_00007DF40154996C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40157B7B8	2_3_00007DF40157B7B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401599AE0	2_3_00007DF401599AE0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40156FA94	2_3_00007DF40156FA94
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401579B70	2_3_00007DF401579B70
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401589B38	2_3_00007DF401589B38
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40153FB24	2_3_00007DF40153FB24
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40160FB04	2_3_00007DF40160FB04
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40161CB04	2_3_00007DF40161CB04
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40153D9F0	2_3_00007DF40153D9F0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4016069A8	2_3_00007DF4016069A8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40157CA38	2_3_00007DF40157CA38
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015FEBE4	2_3_00007DF4015FEBE4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF4015C6C60	2_3_00007DF4015C6C60
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40158DC54	2_3_00007DF40158DC54
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401525C24	2_3_00007DF401525C24
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401609F68	2_3_00007DF401609F68
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401559F4C	2_3_00007DF401559F4C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401550F04	2_3_00007DF401550F04
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40156FDE0	2_3_00007DF40156FDE0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401616DAC	2_3_00007DF401616DAC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401603D84	2_3_00007DF401603D84
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401531E54	2_3_00007DF401531E54
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF40160AE00	2_3_00007DF40160AE00
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_00000251D3090C5C	2_2_00000251D3090C5C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_3_00007DF4E2E92204	6_3_00007DF4E2E92204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_3_00007DF4E2E9392C	6_3_00007DF4E2E9392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_3_00007DF4E2E94EFC	6_3_00007DF4E2E94EFC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D586C25C	6_2_000001E4D586C25C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5872D24	6_2_000001E4D5872D24
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5862628	6_2_000001E4D5862628
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58A0270	6_2_000001E4D58A0270
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5877270	6_2_000001E4D5877270
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5875ADC	6_2_000001E4D5875ADC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5893A38	6_2_000001E4D5893A38
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58A3A4D	6_2_000001E4D58A3A4D
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5894A50	6_2_000001E4D5894A50
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5880174	6_2_000001E4D5880174
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D589E984	6_2_000001E4D589E984
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D589F1D0	6_2_000001E4D589F1D0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587DCE4	6_2_000001E4D587DCE4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D589ECE4	6_2_000001E4D589ECE4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5886D18	6_2_000001E4D5886D18
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5890478	6_2_000001E4D5890478
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58614D0	6_2_000001E4D58614D0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D589CC00	6_2_000001E4D589CC00
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58A6434	6_2_000001E4D58A6434
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587E398	6_2_000001E4D587E398
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5876F24	6_2_000001E4D5876F24
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587C750	6_2_000001E4D587C750
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5887684	6_2_000001E4D5887684
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5883EA4	6_2_000001E4D5883EA4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587BEB8	6_2_000001E4D587BEB8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58886B4	6_2_000001E4D58886B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5895EC8	6_2_000001E4D5895EC8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5894DE8	6_2_000001E4D5894DE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587F618	6_2_000001E4D587F618
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58A0D90	6_2_000001E4D58A0D90
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58955B0	6_2_000001E4D58955B0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58995D4	6_2_000001E4D58995D4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5895918	6_2_000001E4D5895918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D589F940	6_2_000001E4D589F940
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58A0874	6_2_000001E4D58A0874
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5887094	6_2_000001E4D5887094
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D58948D0	6_2_000001E4D58948D0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D587D010	6_2_000001E4D587D010
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D589A81C	6_2_000001E4D589A81C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D588D854	6_2_000001E4D588D854
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D5893F70	6_2_000001E4D5893F70
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_00007DF4E2EA22CC	6_2_00007DF4E2EA22CC
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A53B40	7_2_000002D392A53B40
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A52AA0	7_2_000002D392A52AA0
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A3BC68	7_2_000002D392A3BC68
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A3737C	7_2_000002D392A3737C
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A453C8	7_2_000002D392A453C8
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A54144	7_2_000002D392A54144
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A53210	7_2_000002D392A53210
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A52254	7_2_000002D392A52254
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A49998	7_2_000002D392A49998
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A48980	7_2_000002D392A48980
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A4F76C	7_2_000002D392A4F76C
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A48EB8	7_2_000002D392A48EB8
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A49818	7_2_000002D392A49818
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A4A860	7_2_000002D392A4A860
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A427A4	7_2_000002D392A427A4
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A3BFE4	7_2_000002D392A3BFE4
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A4E51C	7_2_000002D392A4E51C
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A49D30	7_2_000002D392A49D30
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A4A4F8	7_2_000002D392A4A4F8
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A5C500	7_2_000002D392A5C500
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A38DF4	7_2_000002D392A38DF4
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A61E08	7_2_000002D392A61E08
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A3D604	7_2_000002D392A3D604
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A4AE10	7_2_000002D392A4AE10
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A54660	7_2_000002D392A54660
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A5C668	7_2_000002D392A5C668
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A3C5D4	7_2_000002D392A3C5D4
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A525B4	7_2_000002D392A525B4

Source: UGcjMkPWwW.exe, 00000000.00000003.1742498648.0000000003CD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1742866792.0000000004001000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1742498648.0000000003C80000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1742108870.0000000003D23000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000000.1707604650.000000000044B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename4 vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1742437180.0000000000550000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1741895197.0000000003F76000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1741747932.0000000003D78000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1742437180.00000000005E2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe, 00000000.00000003.1742251026.0000000003ECD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UGcjMkPWwW.exe
Source: UGcjMkPWwW.exe	Binary or memory string: OriginalFilename4 vs UGcjMkPWwW.exe

Source: UGcjMkPWwW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.3.OpenWith.exe.251d535d970.5.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.251d535d970.4.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.2.OpenWith.exe.251d535d970.1.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/0@0/2

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF401522634 CreateToolhelp32Snapshot,Thread32First,Thread32Next,CloseHandle,SuspendThread,

2_3_00007DF401522634

Source: C:\Windows\SysWOW64\OpenWith.exe

Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OpenWith.exe, 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1875112434.00000251D4B67000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863278174.00000251D4B6D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2117217556.00007DF401622000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116111905.00000251D51BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: OpenWith.exe, 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1875112434.00000251D4B67000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863278174.00000251D4B6D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2117217556.00007DF401622000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116111905.00000251D51BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OpenWith.exe, 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1875112434.00000251D4B67000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863278174.00000251D4B6D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2117217556.00007DF401622000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116111905.00000251D51BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: OpenWith.exe, 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1875112434.00000251D4B67000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863278174.00000251D4B6D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2117217556.00007DF401622000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116111905.00000251D51BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OpenWith.exe, 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1875112434.00000251D4B67000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863278174.00000251D4B6D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2117217556.00007DF401622000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116111905.00000251D51BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OpenWith.exe, 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1875112434.00000251D4B67000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863278174.00000251D4B6D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2117217556.00007DF401622000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116111905.00000251D51BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: OpenWith.exe, 00000002.00000003.1899461790.00000251D5685000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899889802.00000251D561F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899655925.00000251D5685000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OpenWith.exe, 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1875112434.00000251D4B67000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863278174.00000251D4B6D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2117217556.00007DF401622000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2116111905.00000251D51BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: UGcjMkPWwW.exe	ReversingLabs: Detection: 65%
Source: UGcjMkPWwW.exe	Virustotal: Detection: 82%

Source: unknown	Process created: C:\Users\user\Desktop\UGcjMkPWwW.exe "C:\Users\user\Desktop\UGcjMkPWwW.exe"
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\SysWOW64\OpenWith.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmlaunch.exe "C:\Program Files\Windows Media Player\wmlaunch.exe"
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmlaunch.exe "C:\Program Files\Windows Media Player\wmlaunch.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior

Source: C:\Windows\SysWOW64\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source: UGcjMkPWwW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: UGcjMkPWwW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: UGcjMkPWwW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: UGcjMkPWwW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: UGcjMkPWwW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: UGcjMkPWwW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: UGcjMkPWwW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: UGcjMkPWwW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1742498648.0000000003C80000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742437180.0000000000550000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745057785.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745121603.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742866792.0000000003E20000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745436761.0000000005180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb!8 source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1741895197.0000000003DF0000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1741747932.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744570517.0000000005150000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744423678.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1742108870.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742251026.0000000003DA0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744926026.0000000005100000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744787920.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1741895197.0000000003DF0000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1741747932.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744570517.0000000005150000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744423678.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: UGcjMkPWwW.exe, 00000000.00000003.1742108870.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742251026.0000000003DA0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744926026.0000000005100000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1744787920.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831H source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmlaunch.exe, wmlaunch.exe, 00000006.00000003.2031195643.000001E4D5B30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000006.00000003.2031233133.000001E4D5B60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742866792.0000000003E20000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745436761.0000000005180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: UGcjMkPWwW.exe, 00000000.00000003.1742498648.0000000003C80000.00000004.00000001.00020000.00000000.sdmp, UGcjMkPWwW.exe, 00000000.00000003.1742437180.0000000000550000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745057785.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000001.00000003.1745121603.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmlaunch.exe, 00000006.00000003.2031195643.000001E4D5B30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000006.00000003.2031233133.000001E4D5B60000.00000004.00000001.00020000.00000000.sdmp

Source: UGcjMkPWwW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: UGcjMkPWwW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: UGcjMkPWwW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: UGcjMkPWwW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: UGcjMkPWwW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 2.2.OpenWith.exe.251d535d970.1.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.2.OpenWith.exe.251d535d970.1.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.251d5359d60.6.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.251d5359d60.6.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.2.OpenWith.exe.251d5359d60.2.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.2.OpenWith.exe.251d5359d60.2.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.251d535d970.4.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.251d535d970.4.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.251d535d970.5.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.251d535d970.5.raw.unpack, Runtime.cs	.Net Code: CoreMain

Source: UGcjMkPWwW.exe

Static PE information: section name: .textbss

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00434C62 push es; retf	0_3_00434C91
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00435E69 push ebx; iretd	0_3_00435E6A
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00436A80 push edx; ret	0_3_00436A81
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00434C95 push es; retf	0_3_00434C91
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00432F50 push eax; retf	0_3_00432F51
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00434170 push ecx; iretd	0_3_0043417C
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00436777 push esi; ret	0_3_00436782
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00434130 pushad ; ret	0_3_00434138
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_004361E2 push eax; retf	0_3_004361F1
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_004347A2 push ebp; iretd	0_3_004347A3
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_003DC01A push ds; iretd	0_2_003DC036
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_004312F4 push ecx; ret	0_2_00431307
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_003D1436 push ds; retf	0_2_003D143B
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_003DE5F8 push ebx; ret	0_2_003DE5F9
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF3EE9 push ebx; iretd	1_3_00AF3EEA
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF2CE2 push es; retf	1_3_00AF2D11
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF2822 push ebp; iretd	1_3_00AF2823
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF4262 push eax; retf	1_3_00AF4271
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF21B0 pushad ; ret	1_3_00AF21B8
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF47F7 push esi; ret	1_3_00AF4802
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF21F0 push ecx; iretd	1_3_00AF21FC
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF0FD0 push eax; retf	1_3_00AF0FD1
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF4B00 push edx; ret	1_3_00AF4B01
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF2D15 push es; retf	1_3_00AF2D11
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A30D45 pushad ; retf	7_2_000002D392A30D47
Source: C:\Windows\System32\dllhost.exe	Code function: 7_2_000002D392A304AE push es; ret	7_2_000002D392A304B6

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\OpenWith.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\OpenWith.exe	API/Special instruction interceptor: Address: 54FA83A

Source: C:\Windows\System32\dllhost.exe

Code function: GetAdaptersInfo,

7_2_000002D392A32AC4

Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF4015222DC GetSystemInfo,VirtualAlloc,

2_3_00007DF4015222DC

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: dllhost.exe, 00000007.00000002.2962467867.000002D392B7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: OpenWith.exe, 00000002.00000003.1898161553.00000251D5158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkLinkcLinkSymbolicLink^4
Source: OpenWith.exe, 00000002.00000003.1898161553.00000251D5158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkmbolicLinkSymbolicLink
Source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: OpenWith.exe, 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: OpenWith.exe, 00000002.00000003.1879317732.00000251D5158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMCIDevSymbol
Source: OpenWith.exe, 00000001.00000002.1826940251.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000006.00000002.2963101699.000001E4D5A18000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000002.2962467867.000002D392B7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OpenWith.exe, 00000002.00000003.1879317732.00000251D5158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLinkcLinkSymbolicLink
Source: OpenWith.exe, 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe

Code function: 0_2_00429AB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00429AB4

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_3_00432277 mov eax, dword ptr fs:[00000030h]	0_3_00432277
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_00432277 mov eax, dword ptr fs:[00000030h]	0_2_00432277
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 1_3_00AF0283 mov eax, dword ptr fs:[00000030h]	1_3_00AF0283

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe

Code function: 0_2_00424E5A GetProcessHeap,RtlAllocateHeap,GetModuleFileNameW,_wcsrchr,lstrlenW,GetProcessHeap,RtlFreeHeap,MulDiv,

0_2_00424E5A

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_00425A33 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00425A33
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_00429AB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00429AB4
Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Code function: 0_2_004255A9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004255A9

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmlaunch.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 2D392A30000 protect: page read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory written: C:\Windows\System32\dllhost.exe base: 2D392A30000			Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF70F3314E0			Jump to behavior

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmlaunch.exe "C:\Program Files\Windows Media Player\wmlaunch.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe

Code function: 0_2_00425845 cpuid

0_2_00425845

Source: C:\Windows\System32\OpenWith.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\SysWOW64\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF401541B18 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

2_3_00007DF401541B18

Source: C:\Users\user\Desktop\UGcjMkPWwW.exe

Code function: 0_2_00425490 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00425490

Source: C:\Windows\SysWOW64\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: UGcjMkPWwW.exe, type: SAMPLE
Source: Yara match	File source: 0.0.UGcjMkPWwW.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UGcjMkPWwW.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1743648406.0000000000C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1707524321.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1768649425.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740844173.00000000003C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1827092674.00000000046E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1743471717.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Qtum-Electrum\config
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\ElectronCash\config
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\com.liberty.jaxx
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Exodus
Source: OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets
Source: OpenWith.exe, 00000002.00000002.2117470660.00000251D3118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live&:6

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\thumbnails	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing\google4	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1903745557.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 7404, type: MEMORYSTR

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: UGcjMkPWwW.exe, type: SAMPLE
Source: Yara match	File source: 0.0.UGcjMkPWwW.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UGcjMkPWwW.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1743648406.0000000000C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1707524321.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1768649425.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740844173.00000000003C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1827092674.00000000046E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1743471717.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401574088 socket,bind,	2_3_00007DF401574088
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF401541B18 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	2_3_00007DF401541B18
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 6_2_000001E4D586CDF4 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	6_2_000001E4D586CDF4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	212 Process Injection	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	212 Process Injection	21 Input Capture	131 Security Software Discovery	Remote Desktop Protocol	21 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	21 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	136 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UGcjMkPWwW.exe	66%	ReversingLabs	Win32.Spyware.Rhadamanthys
UGcjMkPWwW.exe	82%	Virustotal		Browse
UGcjMkPWwW.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr	8%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr	true	8%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1frV	wmlaunch.exe, 00000006.00000002.2963426023.000001E4D5C77000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com	OpenWith.exe, 00000002.00000003.1907438108.00000251D568E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t.mc_id=EnterPK201694ba2e0b-6	OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	OpenWith.exe, 00000002.00000003.1900403681.00000251D561B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discordapp.com	OpenWith.exe, 00000002.00000003.1907438108.00000251D568E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1frkernelbasentdllkernel32GetProcessMitigationP	OpenWith.exe, 00000001.00000003.1826414618.000000000534A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	OpenWith.exe, 00000002.00000003.1907554669.00000251D50DA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	OpenWith.exe, 00000002.00000003.1900403681.00000251D561B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	OpenWith.exe, 00000002.00000003.1907554669.00000251D50DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117778749.00000251D50BB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mic	OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2118049130.00000251D5189000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1908124915.00000251D5186000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058668514.00000251D5186000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1939089748.00000251D5186000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066984941.00000251D5189000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	OpenWith.exe, 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1938316310.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899522861.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1899717451.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2117938689.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1933970869.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2058362092.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898982100.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1898402687.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1934822201.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2066321617.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1927967536.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://185.196.11.237:9697/f002171ab05c7/9xqdctgg.ir1fr(	OpenWith.exe, 00000001.00000002.1826825865.0000000000ABC000.00000004.00000010.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.11.237	unknown	Switzerland		42624	SIMPLECARRIERCH	true
193.149.185.109	unknown	Denmark		15411	DANISCODK	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542681
Start date and time:	2024-10-26 07:07:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UGcjMkPWwW.exe renamed because original name is a hash value
Original Sample Name:	14988e9d35a0c92435297f7b2821dc60.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/0@0/2
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 60% Number of executed functions: 156 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target OpenWith.exe, PID 7316 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:08:35	API Interceptor	1x Sleep call for process: wmlaunch.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.196.11.237	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse
185.196.11.237	updater.exe	Get hash	malicious	RHADAMANTHYS	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DANISCODK	yCvCChfuhl.exe	Get hash	malicious	XenoRAT	Browse	193.149.187.135
	0LpFv1haTA.exe	Get hash	malicious	WhiteSnake Stealer, XenoRAT	Browse	193.149.187.135
	175e4400e2e99b0d0ac35bd3fe68519fa91f9ae5cc7a7.exe	Get hash	malicious	Quasar	Browse	193.149.187.135
	file.exe	Get hash	malicious	Quasar, WhiteSnake Stealer	Browse	193.149.187.135
	Bonifico 2692024pdf.exe	Get hash	malicious	FormBook	Browse	195.85.59.61
	_eagjyz.js	Get hash	malicious	Unknown	Browse	193.149.129.167
	_gfsffp.js	Get hash	malicious	Unknown	Browse	193.149.129.167
	_rnnsnn.js	Get hash	malicious	Unknown	Browse	193.149.129.167
	_eagjyz.js	Get hash	malicious	Unknown	Browse	193.149.129.167
	_gfsffp.js	Get hash	malicious	Unknown	Browse	193.149.129.167
SIMPLECARRIERCH	x86_64.bin.elf	Get hash	malicious	Unknown	Browse	185.196.10.215
	fEv4R2ahiLCQa5O.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	PW68YarHboeikgM.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	IND24072113.xlsx	Get hash	malicious	Unknown	Browse	185.196.10.234
	SecuriteInfo.com.Win32.MalwareX-gen.30759.2179.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	185.196.9.150
	request-BPp -RFQ 0975432.exe	Get hash	malicious	PureLog Stealer	Browse	185.196.10.234
	IND24072113_1.xlsx	Get hash	malicious	Unknown	Browse	185.196.10.234
	RepozetorySetup.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	NOXGUARD AUS 40 UREA__912001_NOR_EN - MSDS.exe	Get hash	malicious	Unknown	Browse	185.196.10.234
	tsle.exe	Get hash	malicious	RedLine	Browse	185.196.9.26

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
caec7ddf6889590d999d7ca1b76373b6	XAhzDHAVZ2.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	TctqdRX5Wq.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	g753nr4GI9.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	msvcp110.dll	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	qsKo.ps1	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	DCF368HPtv.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	ji2OQQH0ei.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	zaD1vaze6V.ps1	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	1kfRGncRyD.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109
	5qckfVuvzX.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.149.185.109

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.554199652866149
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UGcjMkPWwW.exe
File size:	433'152 bytes
MD5:	14988e9d35a0c92435297f7b2821dc60
SHA1:	8c00da2ab4cf6da0c179f283eac0053231859f8c
SHA256:	677b8ff45ebb9486a99aecf8dd2b4b362010573ecc4d0d082eda6a36a7cab671
SHA512:	808401d94154a10a5e531b51af6f0a4876b9bbc0c288c33eb964101b30780766a4d7539cb146285d0bceddca4fbc77e072aab91224ab66c29c3feb04a13c2221
SSDEEP:	6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JSt3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbagsViRUF9
TLSH:	5194F14CB5D2C175E9724A32C85496F05E3DBD50CB179EE773A43E293A302E05E32A7A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......UP.\|.1@/.1@/.1@/ZIC..1@/ZIE..1@/ZID..1@/.NE.71@/.ND..1@/.NC..1@/ZIA..1@/.1A/v1@/+.D..1@/.1@/.1@/+../.1@/+.B..1@/Rich.1@/.......

File Icon


Icon Hash:	100109193979390f

Static PE Info

General

Entrypoint:	0x455235
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x645F7B5F [Sat May 13 11:58:23 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1cda62d85d4d631949032bd51ab17a29

Entrypoint Preview

Instruction
call 00007F3B10F3B988h
jmp 00007F3B10F3B55Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F3B10F3B6FBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F3B10F3B6ECh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F3B10F3B6EEh
add edx, 28h
cmp edx, esi
jne 00007F3B10F3B6CCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F3B10F3B6DBh
push esi
call 00007F3B10F3BE75h
test eax, eax
je 00007F3B10F3B702h
mov eax, dword ptr fs:[00000018h]
mov esi, 004798E4h
mov edx, dword ptr [eax+04h]
jmp 00007F3B10F3B6E6h
cmp edx, eax
je 00007F3B10F3B6F2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F3B10F3B6D2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F3B10F3B6E9h
mov byte ptr [004798E8h], 00000001h
call 00007F3B10F3BC60h
call 00007F3B10F3C944h
test al, al
jne 00007F3B10F3B6E6h
xor al, al
pop ebp
ret
call 00007F3B10F3F453h
test al, al
jne 00007F3B10F3B6ECh
push 00000000h
call 00007F3B10F3C94Bh
pop ecx
jmp 00007F3B10F3B6CBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [004798E9h], 00000000h
je 00007F3B10F3B6E6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7794c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7b000	0x1498	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0xf40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x76e40	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x76d80	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x72000	0x164	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x60533	0x60600	8c71992a565121f35b5f27a39b6d6624	False	0.6513709873540856	data	5.481481565943248	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.textbss	0x62000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x72000	0x611e	0x6200	a34d227343b26b448c2fbf0c5a1bcb3e	False	0.4164540816326531	data	4.833087325483854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x79000	0x1320	0xa00	62f04be8889719ef402cb8fde140eaa0	False	0.1546875	DOS executable (block device driver \277DN)	2.040813955897899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7b000	0x1498	0x1600	f89593d6580680aa51828d8936d570bd	False	0.2762784090909091	data	3.8859060526590135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0xf40	0x1000	aee597d25215ac27829b6f1ddaaf38bd	False	0.755615234375	data	6.454880869273466	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7b0f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.2619606003752345
RT_GROUP_ICON	0x7c198	0x14	data	English	United States	1.1
RT_VERSION	0x7c1b0	0x2e4	data	English	United States	0.4554054054054054

Imports

DLL	Import
KERNEL32.dll	CloseHandle, HeapCreate, HeapDestroy, HeapAlloc, HeapFree, GetProcessHeap, WaitForSingleObject, CreateEventA, GetModuleFileNameW, GetModuleHandleA, MulDiv, lstrlenW, WriteConsoleW, CreateFileW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapReAlloc, HeapSize, LCMapStringW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, DecodePointer
USER32.dll	LoadImageA, GetIconInfo, DialogBoxParamA, EndDialog, SendMessageW, InflateRect, SetForegroundWindow, OffsetRect, GetWindowLongA, SendDlgItemMessageA, GetDlgItem, SetWindowPos, UnionRect
ole32.dll	CoInitializeEx, CoTaskMemFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T07:08:09.613244+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	185.196.11.237	9697	192.168.2.4	49730	TCP
2024-10-26T07:08:23.216587+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	185.196.11.237	9697	192.168.2.4	49735	TCP
2024-10-26T07:08:23.216587+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	185.196.11.237	9697	192.168.2.4	49735	TCP
2024-10-26T07:08:33.165194+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	185.196.11.237	9697	192.168.2.4	49738	TCP
2024-10-26T07:08:33.165194+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	185.196.11.237	9697	192.168.2.4	49738	TCP
2024-10-26T07:08:39.290556+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	193.149.185.109	443	192.168.2.4	49739	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 07:08:08.511765957 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:08.517318964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:08.517416954 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:08.517515898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:08.523080111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:09.604239941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:09.607893944 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:09.613244057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:09.929090977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:09.976670980 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:09.982212067 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.318396091 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.318413973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.318419933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.318645000 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.318661928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.318672895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.318684101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.318705082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.318736076 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.319392920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.319402933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.319412947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.319423914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.319580078 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.319911957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.319924116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.319972038 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.327382088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.327460051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.327670097 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.485940933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.486222982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.486238956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.486294031 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.486432076 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.486479998 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.491539001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.491554022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.491595984 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.491822004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.491837978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.491885900 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.496793032 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.496810913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.496850967 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.497065067 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.497082949 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.497128963 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.502142906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.502160072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.502171993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.502187014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.502226114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.502226114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.502377033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.502393961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.502407074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.502448082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.507416010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.507432938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.507466078 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.507630110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.507646084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.507675886 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.515285969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.515511036 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.515547991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.515562057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.515607119 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.524128914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.524241924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.524421930 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.630918980 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.631022930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.631040096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.631072044 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.631328106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.631371975 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.631597042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.631613016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.631644011 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.632024050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.632272959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.632287979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.632308960 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.632730007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.632745028 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.632774115 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.633222103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.633235931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.633250952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.633265972 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.633290052 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.633922100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.634049892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.634100914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.634373903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.634387970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.634402990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.634426117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.635024071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.635040045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.635055065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.635080099 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.635096073 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.635763884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.635901928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.635956049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.636159897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.636176109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.636246920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.638921022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.639091015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.639106035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.639133930 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.645704985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.645750046 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.645786047 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.645853996 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.645895958 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.646073103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.652909994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.652959108 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.653011084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.653026104 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.653062105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.660100937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.660240889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.660254955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.660286903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.667275906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.667342901 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.667385101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.667448997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.667488098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.667650938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.674820900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.674890041 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.674925089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.674940109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.674983025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.681526899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.681673050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.681688070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.681718111 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.688546896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.688563108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.688576937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.688618898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.688633919 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.694562912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.694690943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.694716930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.694749117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.702276945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.702361107 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.702415943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.745920897 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.785073042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.785094976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.785155058 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.785162926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.785346985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.785362959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.785377026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.785393000 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.785418034 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.785981894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.786178112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.786192894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.786221981 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.786712885 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.786727905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.786761045 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.787031889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.787046909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.787062883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.787075996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.787096024 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.787797928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.787990093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.788006067 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.788034916 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.788507938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.788523912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.788537979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.788552046 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.788579941 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.789194107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.789210081 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.789225101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.789251089 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.789834976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.789885044 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.790011883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.790028095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.790067911 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.790683985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.790882111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.790896893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.790925980 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.791405916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.791421890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.791435957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.791452885 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.791454077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.791486025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.792294025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.792315006 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.792335033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.792337894 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.792370081 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.793133020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.793148041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.793162107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.793188095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.793811083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.793826103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.793855906 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.793988943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.794004917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.794028997 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.794327974 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.794363976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.794529915 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.794544935 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.794559956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.794590950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.795397997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.795413971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.795429945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.795444965 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.795459032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.797040939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.797055006 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.797087908 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.797205925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.803246975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.803261042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.803292990 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.804447889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.804492950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.804527044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.810775995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.810791969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.810806036 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.810826063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.810866117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.815529108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.815711021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.815754890 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.819255114 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.819267988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.819298983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.822459936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.822649002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.822765112 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.826035976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.826217890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.826260090 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.830074072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.830252886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.830267906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.830295086 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.837460995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.837475061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.837490082 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.837507963 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.837527037 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.842458963 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.842482090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.842516899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.845087051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.845155001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.845195055 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.851397991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.851543903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.851557970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.851591110 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.856573105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.856617928 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.856739044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.902029037 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.936070919 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.936088085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.936105967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.936131954 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.936500072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.936516047 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.936542034 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.936837912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.936852932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.936878920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.937253952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.937269926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.937295914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.937597990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.937613010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.937628031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.937639952 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.937644005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.937664032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.938565016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.938581944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.938596010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.938608885 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.938611984 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.938627005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.938643932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.938663006 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.939610004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.939661026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.939697027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.939702034 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.939733982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.939763069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.939771891 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.940354109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.940387964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.940388918 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.940423012 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.940454960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.940463066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.940489054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.940529108 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.941215038 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.941250086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.941293955 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.941401005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.941435099 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.941478014 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.942207098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.942240953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.942276001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.942285061 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.942346096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.942398071 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.943306923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.943361044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.943393946 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.943409920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.943428040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.943460941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.943476915 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.943995953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.944031954 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.944048882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.944173098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.944205999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.944216013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.945009947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.945044041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.945058107 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.945076942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.945110083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.945120096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.945142031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.945184946 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.945774078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.945807934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.945852041 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.945921898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.946136951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.946166039 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.946183920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.946198940 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.946232080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.946248055 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.951541901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.951570034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.951601028 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.952881098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.952908993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.952928066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.956928015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.956955910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.956975937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.961407900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.961460114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.961539030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.962743998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.962790966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.963072062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.963102102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.963138103 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.963212013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.973678112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.973730087 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.973830938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.973860025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.973906040 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.974153042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.977000952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.977050066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.977159023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.980248928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.980299950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.980374098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.985210896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.985254049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.985276937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.985290051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.985336065 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.991604090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.991635084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.991668940 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.991673946 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:10.991702080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:10.991755009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.001475096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.001504898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.001547098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.006050110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.006206989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.006248951 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.014995098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.015098095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.015131950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.015146971 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.021634102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.021689892 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.021769047 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.073735952 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.105079889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.105372906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.105386972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.105416059 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.105504036 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.105546951 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.105654955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.105669975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.105705023 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.106110096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.106123924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.106137991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.106153011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.106163025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.106185913 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.107044935 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107059956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107074976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107090950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107095957 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.107105017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107130051 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.107821941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107839108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107852936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.107863903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.107888937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.107968092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.108891010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.108906031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.108920097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.108932018 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.108935118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.108948946 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.108953953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.108966112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.108995914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.109672070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.109687090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.109702110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.109716892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.109730959 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.109734058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.109743118 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.109766006 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.110455990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.110471964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.110510111 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.110606909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.110622883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.110635042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.110661983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.111417055 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.111433029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.111445904 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.111462116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.111475945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.111478090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.111501932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.111515045 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.112369061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.112401962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.112432957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.112440109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.112468004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.112499952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.112509966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.112531900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.112572908 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.113173962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.113207102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.113246918 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.113336086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.113384962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.113418102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.113424063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.113976002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114010096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114022017 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.114145994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114180088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114187956 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.114800930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114835024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114847898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.114866972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114898920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114914894 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.114933014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114964962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.114974976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.115276098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.115303993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.115329027 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.125539064 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.125572920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.125582933 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.125606060 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.125642061 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.127959967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.127990961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.128029108 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.134639978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.134757042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.134794950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.136794090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.136965990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.137003899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.138303041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.138315916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.138353109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.172952890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.173115969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.173131943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.173156977 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.173444986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.173460960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.173475027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.173487902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.173501968 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.174071074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.174083948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.174118996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.175292969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.175487995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.175502062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.175529957 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.190623999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.190674067 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.190681934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.190711021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.190757036 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.200721979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.200758934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.200792074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.200795889 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.201004982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.201050997 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.201472044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.245596886 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.260263920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.260374069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.260417938 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.301727057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.301862001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.301893950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.301947117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.302052975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302088976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302115917 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.302124023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302161932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302196026 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.302791119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302839041 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.302843094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302876949 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302911997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.302917004 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.303493977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.303528070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.303541899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.303561926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.303606033 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.303615093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.304316998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.304352045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.304361105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.304384947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.304419041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.304451942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.304452896 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.304668903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.305151939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.305186987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.305221081 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.305228949 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.305254936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.305286884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.305293083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.305949926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.305984974 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.305996895 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.306020975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.306054115 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.306062937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.306757927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.306792974 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.306806087 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.306823015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.306857109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.306862116 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.306889057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.306931019 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.307578087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.307612896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.307646990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.307653904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.307679892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.307713032 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.307718992 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.308418036 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.308451891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.308474064 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.308480978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.308515072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.308523893 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.308548927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.308594942 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.309680939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309715986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309751034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309756994 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.309783936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309824944 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.309834003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309890032 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309922934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309942007 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.309957027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309988976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.309992075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.310024023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.310055971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.310061932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.310847998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.310883045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.310894966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.310915947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.310950041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.310959101 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.310982943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.311028004 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.317400932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.317512989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.317547083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.317563057 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.317784071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.317830086 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.323750019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.323864937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.323894978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.323905945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.324011087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.324053049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.326644897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.326764107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.326800108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.326826096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.361560106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.361640930 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.361686945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.361720085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.361886024 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.361900091 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.361933947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.361973047 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.362190962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.362334967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.362369061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.362381935 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.362402916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.362440109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.362449884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.362827063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.362916946 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.364280939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.364382029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.364412069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.364428043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.364528894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.364572048 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.387068987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.387104034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.387137890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.387154102 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.398391008 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.398463011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.398477077 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.398499966 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.398542881 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.398739100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.398870945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.398902893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.398933887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.448754072 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.519937038 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520026922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520045042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520097971 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.520245075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520289898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.520365000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520565033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520581007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520610094 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.520826101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520842075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520854950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520865917 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.520872116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.520895004 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.521404982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.521420002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.521434069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.521440983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.521450996 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.521466970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.521473885 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.521482944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.521507025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.522299051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.522315025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.522327900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.522339106 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.522344112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.522360086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.522367954 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.522397995 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.523173094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523189068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523201942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523216963 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523221970 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.523233891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523248911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523261070 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.523292065 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.523842096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523857117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523870945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523885965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523901939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.523907900 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.523942947 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.524775982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.524792910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.524807930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.524822950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.524823904 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.524838924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.524857044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.524857998 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.524874926 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.525731087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.525748014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.525763035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.525773048 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.525779009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.525795937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.525804043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.525810957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.525831938 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.526652098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.526667118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.526681900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.526690006 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.526698112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.526712894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.526720047 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.526730061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.526751041 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.527595043 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.527610064 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.527623892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.527638912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.527641058 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.527654886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.527658939 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.527698994 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.528404951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528422117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528434038 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528449059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528465033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528480053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528481960 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.528489113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.528495073 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528502941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528517008 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.528533936 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.529172897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.529189110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.529217958 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.536485910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.536511898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.536525965 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.536623001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.536665916 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.536719084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.541703939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.541796923 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.541799068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.541815996 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.541848898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.542027950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.542124987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.542138100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.542166948 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.544431925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.544492960 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.544513941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.544528961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.544562101 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.577120066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577146053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577177048 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577203989 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.577415943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577462912 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.577558041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577697992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577712059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577725887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577733040 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.577743053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.577761889 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.580811024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.580851078 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.580889940 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.580905914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.580948114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.604728937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.604875088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.604908943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.605006933 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.741134882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741229057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741266966 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741283894 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.741414070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741449118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741468906 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.741485119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741538048 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.741877079 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741909027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741941929 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.741990089 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.742259026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742292881 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742316961 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.742533922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742562056 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742594957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742598057 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.742645025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742677927 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.742677927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742712021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742724895 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.742744923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.742810011 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.743484020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.743516922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.743551016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.743582010 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.743583918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.743617058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.743650913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.743699074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.743699074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.744282961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744333982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744364977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744398117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744410038 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.744431019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744458914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.744463921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744497061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744529009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.744555950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.744585991 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.745245934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.745279074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.745311022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.745337009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.745346069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.745378971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.745412111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.745423079 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.745469093 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.746172905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.746206045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.746237993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.746260881 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.746270895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.746303082 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.746335030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.746345043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.746367931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.746371031 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.747126102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747159004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747180939 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.747193098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747227907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747260094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747350931 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.747350931 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.747360945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747389078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747421980 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.747435093 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.748090029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.748121977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.748146057 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.748157024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.748189926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.748223066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.748250961 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.748256922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.748267889 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749032021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749064922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749085903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749099970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749133110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749155045 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749165058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749200106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749217033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749248981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749253988 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749263048 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749768019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749803066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749828100 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749835968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749875069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749907017 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749907970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749941111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.749973059 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.749974012 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.750025034 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.760570049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.760668039 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.760699987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.760827065 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.765010118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.765077114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.765109062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.765141010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.765197992 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.768776894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.768893957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.768927097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.768980980 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.769084930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.769117117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.769186974 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.792704105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.792768955 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.792855978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.792896986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.793009996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.793037891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.793071032 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.793104887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.793118000 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.793410063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.793494940 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.793503046 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.795131922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.795186043 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.795197010 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.795219898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.795269012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.937529087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937570095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937623978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937638044 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.937659979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937693119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937746048 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937766075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.937778950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937812090 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.937813997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937845945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937880993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937911987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937920094 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.937920094 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.937944889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.937978029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938010931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938045025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938050032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.938050032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.938079119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938162088 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.938361883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938395023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938427925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938442945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.938461065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938493013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938524961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938529968 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.938560009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.938580990 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.939233065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.939265966 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.939302921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.939335108 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.939351082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.939353943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.939387083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.939419985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.939440012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.939452887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.939519882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.940157890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.940191031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.940223932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.940257072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.940289021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.940303087 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.940303087 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.940321922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.940380096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.941068888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941102982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941133976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941159964 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.941246986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941324949 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.941432953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941464901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941550016 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.941579103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941613913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.941692114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.944819927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.944854021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.944886923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.944920063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.944941044 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.944969893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.944987059 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945003986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945038080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945070982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945101976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945118904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945118904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945135117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945167065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945188999 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945199966 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945233107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945266008 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945288897 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945298910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945318937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945333004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945365906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945389986 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945398092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945430994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945457935 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945467949 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945518970 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945802927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945836067 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945868969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945888042 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.945918083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945951939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.945983887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946017027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946021080 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.946021080 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.946728945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946762085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946795940 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946827888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946841002 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.946841002 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.946888924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946922064 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.946944952 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.946954966 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.947004080 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.947573900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.947607040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.947751045 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.953911066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.953943014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.953975916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.954025984 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.958050013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.958131075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.958162069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.958185911 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.958225965 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.960942984 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.960994005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.961025953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.961102962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.961129904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.961153030 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.986155987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986258984 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986293077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986347914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.986499071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986531019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986567974 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986783028 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.986905098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986937046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986969948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.986993074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.987276077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.987334967 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:11.988135099 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.988212109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.988245010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:11.988270044 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.042623043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.120408058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.120481014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.120517969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.120553017 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.120619059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.120651960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.120673895 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.120685101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.120718956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.120755911 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.121205091 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121253014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121284962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121288061 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.121319056 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121351957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121386051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121392965 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.121392965 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.121912003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121949911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.121982098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.121985912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122020960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122054100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122087002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122106075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.122106075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.122119904 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122179031 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.122672081 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122848988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122881889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122915030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122919083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.122947931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.122972012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.122981071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123013973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123065948 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.123728037 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123761892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123795986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123821974 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.123830080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123862982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123894930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123912096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.123912096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.123928070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.123984098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.124613047 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124646902 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124677896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124711037 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124718904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.124742985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124768019 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.124775887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124809027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124842882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.124866009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.124896049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.125514030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.125546932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.125580072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.125600100 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.125612974 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.125644922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.125678062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.125720978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.125720978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.126399994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.126434088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.126467943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.126499891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.126532078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.126540899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.126540899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.126564026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.126597881 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.126661062 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.127258062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.127290964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.127331018 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.127343893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.127377033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.127408981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.127409935 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.127443075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.127465010 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.127475977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.127532005 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.128160954 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128194094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128226042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128258944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128289938 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.128292084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128324986 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.128325939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128377914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.128895998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128928900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128961086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.128994942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129026890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129043102 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.129043102 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.129059076 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129092932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129125118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129127979 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.129158974 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129223108 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.129744053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129777908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129810095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129842997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129883051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.129900932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.129919052 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.129926920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.133071899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.133142948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.133177042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.133210897 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.138130903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138164043 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138197899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138199091 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.138247967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138250113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.138282061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138310909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138369083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.138394117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138426065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.138452053 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.170734882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.170770884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.170805931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.170845032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.170845032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.170905113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.170938015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.170970917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.170989037 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.171004057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.171294928 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.171483994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.171672106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.171705961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.171739101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.171772957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.171792030 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.171792030 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.214385986 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.298650026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.298778057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.298815012 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.298866034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.298898935 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.298911095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.298911095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.298949003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.298981905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299012899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.299264908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299349070 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.299405098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299433947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299493074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.299611092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299643993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299676895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299710035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.299729109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.299825907 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.299962044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300010920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300045967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300077915 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300080061 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.300112009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300136089 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.300144911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300189972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300199986 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.300781965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300813913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300847054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300879002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300889015 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.300889015 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.300911903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300944090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.300976992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.301011086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.301021099 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.301021099 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.301592112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.301624060 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.301656961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.301680088 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.301688910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.301723003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.301754951 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.301774025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.302231073 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.302310944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.302342892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.302369118 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.302376986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.302411079 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.302419901 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.302444935 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.302489042 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.302495003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303133965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303168058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303198099 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.303199053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303231955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303265095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303297043 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303318024 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.303318977 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.303345919 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303380013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303412914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.303934097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303966045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.303997993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304030895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304037094 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.304037094 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.304064035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304096937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304128885 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304168940 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.304168940 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.304862022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304894924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304927111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304953098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.304960012 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.304991961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305025101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305058002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305072069 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.305072069 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.305088997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305154085 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.305803061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305835962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305867910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305891037 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.305901051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305933952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305953026 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.305967093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.305998087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306030989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306061983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.306071043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.306756020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306788921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306822062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306854010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306854963 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.306889057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306902885 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.306921005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306952000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306986094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.306994915 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.307099104 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.307517052 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307550907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307583094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307610989 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.307615042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307648897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307681084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307713985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307718039 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.307738066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.307745934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307777882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.307862043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.307962894 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.312021971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.312076092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.312108994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.312155962 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.312155962 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.315238953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.315291882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.315345049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.315347910 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.316912889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.316965103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.316966057 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.316996098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.317029953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.317065001 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.351675987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.351735115 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.351767063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.351769924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.351815939 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.351934910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.351968050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352086067 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.352119923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352154016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352231979 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.352360964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352411985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352444887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352478027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352503061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352524996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.352524996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.352730989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352746010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352761030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352776051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.352798939 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.352798939 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.401855946 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.495445013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495507956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495544910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495578051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495613098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495632887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.495661974 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.495682001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495721102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495749950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.495754957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495788097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495821953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.495831013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.495928049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.496198893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496263981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496298075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496305943 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.496332884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496427059 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.496592045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496624947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496659040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496682882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.496691942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.496736050 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.497145891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497178078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497210979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497243881 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497245073 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.497277021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497311115 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497344017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497371912 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.497371912 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.497376919 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.497435093 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.498009920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498044968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498074055 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498115063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.498123884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498158932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498191118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498220921 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.498223066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498256922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498290062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498296022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.498296022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.498322964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.498485088 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.499028921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499063969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499097109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499130011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499162912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499170065 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.499170065 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.499196053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499228001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499248028 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.499262094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499295950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499339104 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.499882936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499916077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499937057 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.499950886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.499984026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500016928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500051975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500066996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.500066996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.500086069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500118971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500164032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.500819921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500854969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500886917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500920057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500931978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.500931978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.500953913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500986099 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.500997066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.501022100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501055956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501090050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501097918 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.501179934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.501802921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501851082 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501883030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501914024 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.501914978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501950026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.501982927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502016068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502026081 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.502026081 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.502051115 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502084017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502144098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.502759933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502794027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502827883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502861977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502870083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.502870083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.502893925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502928019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.502959013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503006935 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503021002 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.503021002 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.503047943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503130913 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.503400087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503540993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503575087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503607988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503617048 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.503640890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503658056 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.503673077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503707886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503712893 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.503741026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503772974 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503807068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.503846884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.503846884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.505702972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.505754948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.505789042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.505834103 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.507191896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.507244110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.507261992 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.507276058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.507350922 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.508043051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.508071899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.508290052 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.508984089 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.508984089 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.535671949 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535742998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535778999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535811901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535845995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535856009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.535856009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.535878897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535912991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535938978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.535947084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.535983086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536050081 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.536103010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536130905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536158085 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.536216021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536248922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536273003 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.536284924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536319017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536353111 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.536551952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536583900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536607981 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.536617041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536652088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.536746979 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.537406921 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.537406921 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.673686028 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.673818111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.673851967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.673887014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.673902035 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.673943996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.673955917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.673990965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674024105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674038887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.674058914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674161911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674220085 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.674226999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674261093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674282074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.674457073 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674489975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674534082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.674619913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674648046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674664021 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.674680948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674714088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674747944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674757957 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.674781084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.674786091 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.675098896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675131083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675164938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675183058 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.675198078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675205946 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.675231934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675266981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675317049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.675579071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675625086 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.675685883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675719023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675751925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675785065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675807953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.675818920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675829887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.675853968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675883055 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.675929070 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.676294088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676326990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676337004 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.676359892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676393986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676426888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676436901 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.676467896 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.676708937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676872015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676907063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676940918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676950932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.676974058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.676981926 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.677006960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677042007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677073956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677088976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.677108049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677117109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.677140951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677797079 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677829981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677853107 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.677862883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677877903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.677896023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677923918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677956104 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677967072 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.677989960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.677997112 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.678024054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678056955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678088903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678111076 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.678138971 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.678699970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678733110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678765059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678776979 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.678798914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678831100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678863049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678874969 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.678895950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.678906918 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.678931952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679035902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.679295063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679346085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679397106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679430962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679442883 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.679464102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679470062 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.679497957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679529905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679563046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679572105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.679594994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.679605961 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.679627895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680357933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680392027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680404902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.680423975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680428028 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.680457115 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680489063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680490971 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.680521965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680555105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680587053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680602074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.680619955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.680629969 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.680654049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681301117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681334019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681349993 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.681368113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681376934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.681401014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681432962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681468010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681482077 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.681500912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681512117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.681535006 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681567907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681600094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.681612015 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.681643009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.682005882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.682040930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.682550907 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.682754993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.682782888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.682816029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.682863951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.682868004 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.682908058 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.684078932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.684176922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.684210062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.684263945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.684983015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.685026884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.685034037 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.693308115 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.715492010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715558052 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.715562105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715620041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715655088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715688944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715706110 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.715722084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715730906 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.715774059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715806961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715841055 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715852022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.715873957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715883017 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.715907097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715935946 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715967894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.715986967 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.716001034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716012001 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.716036081 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716068029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716113091 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.716119051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716152906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716156960 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.716185093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716217041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716248989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716259956 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.716280937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.716291904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.733064890 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.758544922 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.841855049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.841897964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.841953039 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.841964006 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.841989040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842024088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842057943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842072010 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842111111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842147112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842159986 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842175007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842210054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842243910 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842305899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842339993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842351913 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842372894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842410088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842422009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842458010 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842565060 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842597008 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842629910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842662096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842673063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842703104 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.842715979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.842749119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843015909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843035936 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843045950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843079090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843112946 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843123913 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843144894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843156099 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843177080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843215942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843259096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843518019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843550920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843565941 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843585014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843619108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843652010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843662024 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843684912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843693018 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843718052 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843878984 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.843964100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.843996048 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844029903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844063044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844064951 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.844096899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844103098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.844132900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844268084 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.844495058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844546080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844578981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844611883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844630957 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.844645023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844656944 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.844679117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844712973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844746113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844748974 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.844779968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844788074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.844811916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844845057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.844856024 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.845453978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845489025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845505953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.845523119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845556021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845587969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845592976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.845621109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845628977 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.845654011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845686913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845720053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845730066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.845752001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845761061 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.845784903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845818996 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.845865011 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.846318960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846353054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846386909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846405983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.846420050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846426964 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.846452951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846487045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846522093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846534014 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.846563101 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.846853018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846887112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846920013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846954107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846967936 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.846987009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.846995115 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.847018957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847053051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847085953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847100019 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.847119093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847127914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.847151041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847186089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847229958 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.847817898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847852945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847884893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847901106 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.847918034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847925901 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.847949982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.847982883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848016024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848026991 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.848048925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848054886 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.848082066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848115921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848149061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848159075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.848189116 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.848731995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848767042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848798990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848831892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848844051 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.848865986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848874092 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.848898888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848931074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848963022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.848975897 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.848997116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.849003077 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.849030972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.849064112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.849098921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.849107981 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.849140882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.849519014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.850754023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.850788116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.850841045 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.851885080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.851950884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.851954937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.851969957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.853167057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.853213072 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.853226900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.853243113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.853265047 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.859117985 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.885595083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.885668993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.885704041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.885723114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.885744095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.885807991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.885842085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.885889053 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.885968924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886001110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886113882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.886188984 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886221886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886255026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886287928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886301041 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.886322975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886327028 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.886621952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886656046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886688948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886707067 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.886722088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886729956 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.886755943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886789083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886823893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886833906 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.886852026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:12.886864901 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.887923956 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:12.887939930 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.009557009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.009614944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.009690046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.009725094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.009742022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.009762049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.009766102 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.009803057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.009831905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.009881973 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.009974957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010009050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010019064 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.010044098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010077000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010109901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010117054 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.010150909 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.010201931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010266066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010298967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010332108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010339022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.010373116 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.010529995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010564089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010597944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010631084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010652065 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.010668039 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010673046 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.010927916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010960102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.010993958 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011004925 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.011029959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011063099 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011069059 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.011094093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011101007 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.011126995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011159897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011171103 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.011421919 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011455059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011468887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.011487961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011521101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011554956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011563063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.011589050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011596918 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.011893988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011943102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011976004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.011985064 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012008905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012016058 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012044907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012077093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012110949 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012116909 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012144089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012149096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012178898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012669086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012701035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012713909 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012734890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012742996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012767076 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012799978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012831926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012840033 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012866020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012873888 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012897968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012928963 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012960911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.012969971 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.012994051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013003111 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.013027906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013183117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.013612986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013645887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013679028 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013711929 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013720036 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.013742924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013751984 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.013776064 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013803959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013817072 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.013835907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013869047 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013901949 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013951063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013987064 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.013998032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.013998032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.014029980 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.014374971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014425993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014458895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014492035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014504910 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.014524937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014530897 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.014558077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014590979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014622927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014631033 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.014661074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014666080 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.014693022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014725924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.014729977 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015393019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015427113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015444994 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015459061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015491962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015528917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015536070 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015562057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015568018 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015594959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015626907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015657902 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015666008 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015691042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015697002 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015705109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015723944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015755892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015772104 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.015786886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.015825987 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.016232014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016264915 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016318083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016350985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016365051 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.016382933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016395092 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.016417027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016448975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016483068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016493082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.016515017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016525030 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.016547918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016580105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016612053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.016622066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.016654968 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.017194033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017227888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017260075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017270088 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.017292976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017326117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017359018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017369986 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.017391920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017401934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.017425060 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017457962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.017507076 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.021071911 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.021114111 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.023117065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.023145914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.023196936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.023201942 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.023226023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.023273945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.024388075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.024660110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.024707079 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.024710894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.024740934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.024772882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.024816036 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.026352882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.026422977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.026454926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.026484013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.026498079 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.040563107 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.059767962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.059823990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.059859037 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.059906006 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.059921026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.059953928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.059963942 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.059988022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060089111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060117006 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060132980 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060161114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060190916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060225964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060288906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060328960 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060415983 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060445070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060458899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060478926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060513020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060545921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060549974 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060587883 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060657024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060736895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060765028 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060805082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060874939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060903072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060916901 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.060935020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.060969114 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.061007977 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.061075926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.061109066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.061116934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.061141968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.061175108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.061214924 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172378063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172425032 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172504902 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172544003 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172558069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172594070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172631025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172652960 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172665119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172678947 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172699928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172750950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172776937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172785044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172817945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172827959 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172852039 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172884941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172919989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172933102 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172952890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.172972918 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.172986031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173013926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173063993 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173070908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173105001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173137903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173146963 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173172951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173182011 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173224926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173258066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173291922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173300028 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173326969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173331022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173362017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173440933 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173583031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173610926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173644066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173676968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173708916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173737049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173743010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173775911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173800945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.173809052 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.173856020 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174047947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174081087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174113989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174135923 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174153090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174185991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174201012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174217939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174252033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174267054 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174285889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174331903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174654961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174690008 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174725056 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174738884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174760103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174793959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174820900 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174828053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174863100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174881935 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.174896955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174931049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.174978018 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.175474882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175518990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175532103 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.175555944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175590992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175625086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175630093 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.175661087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175674915 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.175694942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175729036 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175764084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175776958 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.175800085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175812006 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.175913095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175946951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175981045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.175992012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176014900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176028967 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176052094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176084995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176119089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176132917 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176151991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176166058 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176186085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176218033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176250935 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176265001 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176285028 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176299095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176743031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176778078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176791906 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176829100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176865101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176881075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176898956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176933050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176943064 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.176965952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.176999092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177021027 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.177033901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177067995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177083015 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.177100897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177134991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177150011 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.177167892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177216053 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.177561998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177745104 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177781105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177800894 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.177814007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177849054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177859068 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.177879095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177911997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177928925 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.177946091 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.177978992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178013086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178025961 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178046942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178061008 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178081036 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178113937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178143978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178477049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178527117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178659916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178694010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178729057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178740025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178762913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178764105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178796053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178824902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178831100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178845882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178864002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178898096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178911924 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178930998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178944111 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.178965092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.178997993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.179045916 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.179476976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.179512024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.179546118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.179559946 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.179579020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.179593086 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.179656982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.179701090 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.181727886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.181763887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.181782007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.181797981 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.181812048 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.181828022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.181864023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.182044983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.182849884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.182903051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.182918072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.182945013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.184096098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.184140921 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.184151888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.184166908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.184206963 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.184684038 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.184708118 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.220689058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.220746040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.220779896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.220794916 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.220814943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.220902920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.220935106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.220952034 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.220968962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.220993042 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221023083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221164942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221199989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221213102 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221246958 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221298933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221333027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221465111 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221498013 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221510887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221532106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221544981 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221622944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221654892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221671104 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221692085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221738100 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221807003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221839905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221884012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.221939087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.221966982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.222001076 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.222012997 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.222080946 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.222114086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.222129107 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.276920080 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314251900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314299107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314335108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314368963 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314403057 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314431906 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314445019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314480066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314513922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314522982 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314547062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314599991 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314631939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314644098 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314666986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314675093 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314721107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314770937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314804077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314812899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314836979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314846039 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314867020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314902067 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314935923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.314944983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314977884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.314990997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315083027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315116882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315150023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315160990 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315185070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315192938 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315355062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315383911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315409899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315416098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315449953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315462112 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315483093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315515995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315529108 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315550089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315584898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315593958 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315747023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315805912 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315857887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315891981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315923929 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315937042 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.315958023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.315990925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316004992 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.316028118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316076040 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.316273928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316308022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316342115 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316356897 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.316376925 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316411018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316426039 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.316443920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316478014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316502094 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.316512108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316545010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316566944 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.316920042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316948891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.316971064 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.316981077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317015886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317034960 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317053080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317086935 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317104101 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317118883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317152977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317167997 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317186117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317219973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317234993 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317253113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317286968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317308903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317320108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317358017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317364931 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317388058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317691088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317723989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317743063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317769051 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317775965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317810059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317843914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317877054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317888975 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317910910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317922115 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.317944050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.317979097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318011999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318022966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.318048000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318057060 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.318084002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318460941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318506956 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.318511009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318545103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318557978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.318578959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318614006 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318628073 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.318649054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318682909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318696022 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.318717003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318749905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318762064 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.318783998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.318829060 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.319197893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319231987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319264889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319281101 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.319298983 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319353104 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319387913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319401979 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.319421053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319432974 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.319453955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319487095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319499969 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.319520950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319555044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319566011 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.319587946 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319622040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.319644928 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320034981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320069075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320096016 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320121050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320154905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320167065 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320188999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320223093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320238113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320255995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320290089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320324898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320338964 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320358992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320372105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320393085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320425987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320460081 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320476055 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320486069 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320497990 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320508003 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320621014 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.320929050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320962906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.320997000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321014881 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.321037054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321046114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.321070910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321104050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321156979 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.321382999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321422100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321432114 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.321518898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321532965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321548939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321557045 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.321564913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.321594954 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.322601080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.322638988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.322647095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.322654009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.322868109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.323431015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.323443890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.323487043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.323498011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.323510885 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.323548079 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.326348066 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.358958006 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359014034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359046936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359080076 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.359081984 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359127998 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.359217882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359251976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359380960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359414101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359431982 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.359447956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359453917 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.359540939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359661102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359693050 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359705925 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.359736919 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.359791040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359823942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359860897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.359904051 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.359982967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360028982 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.360094070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360126972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360179901 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.360244989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360276937 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360311985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360344887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360359907 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.360377073 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360389948 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.360486031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360515118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360560894 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.360564947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360593081 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.360614061 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.401851892 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.412992001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.413057089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.419051886 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.469990015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470040083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470069885 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470103979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470127106 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470144033 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470215082 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470305920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470340967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470392942 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470439911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470474958 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470490932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470515966 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470542908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470591068 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470645905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470679045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470695972 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470712900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470746040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470791101 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470877886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470906973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470921993 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.470958948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.470993042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471035957 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471096992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471131086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471143961 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471163988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471191883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471225023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471231937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471261024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471287966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471426010 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471458912 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471493006 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471494913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471537113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471584082 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471612930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471646070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471681118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471687078 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471714020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471822023 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471865892 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471899033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471910954 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.471934080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471966982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.471999884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472009897 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472038031 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472152948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472182035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472213984 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472248077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472259998 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472280979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472290993 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472313881 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472347021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472379923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472385883 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472412109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472429991 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472460032 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472501993 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472666025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472700119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472733021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472765923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472769976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472799063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472810030 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472829103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472860098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472894907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472903967 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472929001 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472935915 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.472961903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.472996950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473072052 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473216057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473246098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473268032 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473294973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473330021 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473330975 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473361969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473395109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473428965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473437071 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473462105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473474026 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473491907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473522902 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473556995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473562956 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473598003 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473606110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473639011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473670959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473704100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473726988 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.473732948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473767042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.473769903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474133015 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474167109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474184990 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474201918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474211931 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474236965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474266052 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474298000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474309921 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474333048 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474335909 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474365950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474399090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474431992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474441051 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474466085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474473953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474498987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474531889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474565029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474584103 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474598885 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474608898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.474632025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474666119 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.474706888 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475166082 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475200891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475233078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475254059 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475265026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475280046 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475294113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475347996 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475382090 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475390911 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475415945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475436926 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475449085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475481987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475517035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475528955 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475548983 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475558996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475581884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475615025 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475650072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475661039 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475682020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.475683928 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.475966930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476000071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476032019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476061106 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476064920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476098061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476108074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476130009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476136923 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476162910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476191998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476221085 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476224899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476258039 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476278067 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476289988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476322889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476356030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476361990 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476388931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476394892 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476421118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476453066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476461887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476481915 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476515055 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476555109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476663113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476696968 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476914883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476950884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.476965904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.476984024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477016926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477051020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477060080 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477085114 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477089882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477118969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477152109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477184057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477193117 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477216005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477222919 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477246046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477279902 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477313995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477324009 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477345943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477354050 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477380037 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477413893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477447033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477456093 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477485895 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.477655888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477701902 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.477746964 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.479743004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.479795933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.479831934 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.479895115 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.479912043 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.479948044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.479974031 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.481093884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.481137991 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.481146097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.481178999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.481358051 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.481883049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.481899023 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.482505083 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.482517958 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.482533932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.482557058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.482557058 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.483232021 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.502099037 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.533890963 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.533936024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534004927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534061909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534099102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534122944 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.534122944 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.534151077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534179926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534199953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.534214020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534249067 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534282923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534303904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.534317970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534327030 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.534357071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534564018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534610033 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.534616947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534652948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534657001 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.534735918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534768105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.534811974 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.536207914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536242008 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536268950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.536278009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536351919 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536385059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536400080 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.536420107 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536431074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.536670923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536705971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536740065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536772966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.536775112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536789894 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.536811113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536845922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536859035 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.536880016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.536927938 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.648828030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.648870945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.648911953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.663707972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.663767099 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.663817883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.663819075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.663856983 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.663887024 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.663911104 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.663921118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.663955927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664007902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664046049 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664081097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664088964 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664177895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664211988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664242029 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664325953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664360046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664369106 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664395094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664423943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664462090 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664488077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664540052 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664549112 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664573908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664624929 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664685011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664719105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664752007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664760113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664784908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664819002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.664863110 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.664974928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665009022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665046930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665059090 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665117025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665141106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665191889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665225029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665235043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665257931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665292978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665316105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665323019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665373087 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665565014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665612936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665647030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665680885 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665687084 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665714979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665744066 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665766954 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665776014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665798903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.665812016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665841103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.665854931 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666009903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666043997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666079044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666112900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666146994 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666162014 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666289091 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666323900 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666337013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666356087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666389942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666424036 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666457891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666469097 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666469097 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666491985 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666526079 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666558981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666568995 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666593075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666625977 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666656971 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666675091 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666759014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666793108 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666826963 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666861057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666893959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666899920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666899920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.666922092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666955948 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666989088 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.666992903 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667022943 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667042017 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667058945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667093992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667135000 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667496920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667526007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667558908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667591095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667593002 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667599916 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667625904 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667659998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667668104 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667687893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667721033 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667737961 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667754889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667789936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667819977 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667823076 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667857885 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.667865038 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.667998075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668028116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668041945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668061972 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668097019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668107033 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668129921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668163061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668196917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668211937 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668230057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668257952 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668291092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668301105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668301105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668323994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668351889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668368101 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668384075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668418884 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668425083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668447018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668483019 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668809891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668843031 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668876886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668905973 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668910027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668945074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.668958902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.668973923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669007063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669012070 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669042110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669075012 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669107914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669114113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669141054 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669156075 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669174910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669209003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669231892 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669241905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669275045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669282913 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669442892 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669730902 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669764996 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669794083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669797897 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669832945 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669837952 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669867992 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669900894 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669934988 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.669934988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669967890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.669998884 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670001030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670036077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670046091 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670068979 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670099020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670109987 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670130968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670165062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670200109 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670206070 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670233011 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670249939 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670485973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670515060 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670547009 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670552015 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670581102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670614004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670619011 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670648098 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670681000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670715094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670725107 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670725107 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670747995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670782089 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670799017 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670810938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670844078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670877934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670878887 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670911074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670922041 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.670944929 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.670984983 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.671279907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.671333075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.671366930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.671390057 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.671401978 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.671436071 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.671457052 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.671469927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.671545982 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.672210932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.676702976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.676970005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.676994085 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.677012920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.677012920 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.677030087 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.677046061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.677062988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.677069902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.677082062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.677088976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.677172899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.680136919 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.680150986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.680166960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.680229902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.680247068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.680263042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.680279016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.680303097 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.680315971 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.726680040 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.726711035 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.726744890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.726816893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.726850986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.726854086 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.726854086 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.726885080 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.726924896 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.726953983 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.726983070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.727018118 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.727057934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.727088928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.727123022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.727143049 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.727157116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.727209091 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.728027105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.728141069 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.728171110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.728214025 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.728221893 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.728256941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.728282928 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.728292942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.728338957 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.729643106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729672909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729708910 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729743958 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.729759932 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729793072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729826927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729863882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.729863882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.729899883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729953051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.729981899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730017900 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.730048895 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730082989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730098963 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.730115891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730175972 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.730199099 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730226994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730278969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730309963 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.730313063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730348110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.730390072 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.776906013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829291105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829324007 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829375029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829421043 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829423904 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829457045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829485893 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829507113 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829540014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829559088 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829572916 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829602957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829616070 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829636097 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829670906 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829699039 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829699993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829731941 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829740047 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829766989 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.829833031 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.829988956 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830204964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830240965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830274105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830276012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.830338001 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.830355883 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830389023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830423117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830434084 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.830456018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830490112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830499887 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.830523014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830566883 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.830686092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830718994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830750942 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830759048 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.830785036 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830900908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830933094 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.830961943 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.830965042 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831034899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831068993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831074953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831074953 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831254005 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831286907 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831305981 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831342936 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831393003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831425905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831445932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831459999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831492901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831520081 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831526041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831532955 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831753969 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831789017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831820965 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831842899 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831855059 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831876040 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831887960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831919909 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831948996 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831980944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.831988096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.831988096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832252026 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832284927 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832314014 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832317114 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832350016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832385063 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832402945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832416058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832448959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832461119 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832477093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832509995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832529068 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832559109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832560062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832587957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832637072 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832669973 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832675934 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832700968 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832735062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832756996 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832768917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832794905 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832802057 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832835913 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832878113 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832885981 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832920074 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832952976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.832953930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.832983017 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833000898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833038092 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833072901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833087921 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833106995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833139896 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833168030 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833203077 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833203077 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833203077 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833237886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833271027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833285093 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833302975 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833336115 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833348989 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833370924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833401918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833410978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833436012 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833468914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833473921 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833503962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833542109 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833724976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833756924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833791018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833800077 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833823919 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833865881 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833873987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833901882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833935976 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.833954096 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.833970070 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834001064 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834022045 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834033966 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834063053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834095955 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834104061 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834127903 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834161997 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834194899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834201097 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834201097 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834388971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834422112 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834455967 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834461927 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834500074 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834541082 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834574938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834608078 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834640980 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834661007 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834673882 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834691048 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834726095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834759951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834791899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834801912 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834820986 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834851980 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834881067 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834883928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834917068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834934950 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834949970 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.834975004 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.834981918 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835016012 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.835406065 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835439920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835474014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835505962 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835514069 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.835558891 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835561037 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.835593939 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835624933 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835654020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835686922 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.835686922 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.835686922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835720062 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835752964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835786104 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835819006 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835824013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.835824013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.835851908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835885048 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.835901976 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836139917 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836169004 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836185932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836200953 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836235046 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836241961 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836306095 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836339951 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836373091 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836405993 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836426020 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836426973 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836436987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836471081 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836503029 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836507082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836535931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836546898 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836568117 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836602926 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836611986 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836633921 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836667061 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836694002 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.836699963 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836733103 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.836775064 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.839781046 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.839781046 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.840857983 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.840886116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.840919018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.840928078 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.840951920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.840974092 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.841006041 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.841042995 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.841056108 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.841074944 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.841108084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.841137886 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.841166019 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.841170073 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.841182947 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.842866898 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.842880964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.842896938 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.842941999 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.842941999 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.843030930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.843045950 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.843086004 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.850446939 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.877444983 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877496958 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877531052 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877563000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877595901 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877605915 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.877605915 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.877645016 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877679110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877711058 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877743959 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877748966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.877748966 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.877778053 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.877832890 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.878292084 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878456116 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878484964 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878505945 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.878518105 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878551960 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878576994 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.878583908 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878617048 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878706932 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.878782034 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.878838062 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.879568100 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.879748106 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.879781961 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.879816055 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.879844904 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.879849911 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.879873991 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.880038023 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880069971 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880105019 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880137920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880157948 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.880172014 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880201101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880234957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880243063 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.880244017 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.880269051 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880300999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880309105 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.880335093 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.880565882 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.933274031 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.972120047 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972176075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972209930 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972249985 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.972318888 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972352982 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972387075 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972426891 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.972428083 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.972707987 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972757101 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972790003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972805023 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.972822905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972856045 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972872972 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.972888947 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972923994 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.972966909 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973031998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973064899 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973097086 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973104954 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973129988 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973162889 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973195076 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973205090 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973205090 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973228931 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973330975 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973594904 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973628044 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973660946 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973707914 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973707914 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973741055 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973771095 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973773003 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973807096 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973861933 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973923922 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973963022 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.973989010 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.973995924 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974030018 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974062920 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974096060 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974107027 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974107981 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974129915 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974162102 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974195957 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974227905 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974227905 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974261999 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974272013 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974298000 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974348068 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974567890 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974601984 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974632978 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974637032 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974668980 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974700928 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974710941 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974734068 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974767923 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974800110 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974813938 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974813938 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.974874020 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.974927902 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.982862949 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.986226082 CEST	49730	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:13.990061998 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:13.993700027 CEST	9697	49730	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:22.344957113 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:22.350522995 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:22.350605965 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:22.350714922 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:22.356100082 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.203424931 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.203466892 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.203526974 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:23.211091042 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:23.216587067 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.466121912 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.466325998 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:23.471961975 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.719758034 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.722223997 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:23.727735996 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.727817059 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:23.733247995 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.978339911 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.981426954 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:23.986880064 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:23.987054110 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:23.992670059 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.237504005 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.237555981 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.237940073 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.317025900 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.317169905 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.317228079 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.317332029 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.322410107 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.322537899 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.322603941 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.322624922 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.322695017 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.322698116 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.322745085 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.322746038 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.322773933 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.322797060 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.322848082 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.322874069 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.322948933 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.322976112 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.323004961 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.323012114 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.323040962 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.323045015 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.323069096 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.323103905 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.323132038 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.327672005 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.327744007 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.327768087 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.327814102 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.327889919 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.327950954 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328078032 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328154087 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328192949 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328221083 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328247070 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328253984 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328280926 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328318119 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328368902 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328438997 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328443050 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328490973 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328527927 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328558922 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328596115 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328624964 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328625917 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328690052 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.328700066 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.328778982 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.333136082 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.333353996 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.333528042 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.333659887 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.333748102 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.333837986 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334033012 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334150076 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334182024 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334208965 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334255934 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334284067 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334460974 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334527016 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334554911 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334603071 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334630013 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334657907 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334685087 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.334712029 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.842061996 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.886358023 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.974495888 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.974612951 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.974669933 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.974765062 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.974795103 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:24.980179071 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980221033 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980251074 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980308056 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980339050 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980392933 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980470896 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980499983 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980526924 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980555058 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980606079 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980638981 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980674028 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980701923 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:24.980730057 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.235872984 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.292829990 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:25.654758930 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:25.654881954 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:25.654948950 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:25.660705090 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660792112 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660820961 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660852909 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660881996 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660908937 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660921097 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:25.660937071 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660969973 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.660998106 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.666389942 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.912162066 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:25.964531898 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:26.917609930 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:26.924348116 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:26.924498081 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:26.929893017 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:27.174925089 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:27.175097942 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:27.175178051 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:27.180537939 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:27.180948019 CEST	9697	49735	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:27.181123972 CEST	49735	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:32.168036938 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:32.175350904 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:32.175503016 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:32.175609112 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:32.182415962 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.030827045 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.030900955 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.030982018 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:33.159796000 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:33.165194035 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.430418968 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.432202101 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:33.437622070 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.737052917 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.744617939 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:33.750006914 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:33.750116110 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:33.755533934 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.007042885 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.010761023 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.017668962 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.017746925 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.025171041 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.291414022 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.293560028 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.293668985 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.293709040 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.293745041 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.293776989 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.293776989 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.294414997 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.294450045 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.294491053 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.304300070 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.304333925 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.304368973 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.304368973 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.304425001 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.315445900 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.315479040 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.315514088 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.315534115 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.370904922 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.410614014 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.410689116 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.410707951 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.410839081 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.410963058 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.411011934 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.411026001 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.453365088 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.453399897 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.453444958 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.453449965 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.453499079 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.457657099 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.457710028 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.457741976 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.457767963 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:34.465054035 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:34.465125084 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.550141096 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.555623055 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.555696011 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.561002016 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.815119982 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.815165043 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.815200090 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.815243959 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.824243069 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.824330091 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.827303886 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.827352047 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.827385902 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.827403069 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.833081961 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.833133936 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.833148956 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.833182096 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.833233118 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.841037035 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.841140032 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.841172934 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.841212988 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.886332035 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.931262970 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931418896 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931457043 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931499958 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.931507111 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931554079 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931587934 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.931756973 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931823969 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.931826115 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931859970 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.931936979 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.932486057 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.938189030 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.938222885 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.938297033 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.938297033 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.938324928 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.938379049 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.941309929 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.941343069 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.941406012 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.941420078 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.941493988 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.941622972 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.941657066 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.941740990 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.949956894 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.950221062 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.950253963 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.950289011 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.950309992 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.950323105 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.950387955 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.957982063 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.958075047 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.958107948 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.958117008 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.958179951 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:36.958404064 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.958436012 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:36.958539963 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.048563957 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.048685074 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.048715115 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.048748970 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.048751116 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.048785925 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.048823118 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.049335003 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.049370050 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.049393892 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.049442053 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.049499035 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.049530983 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.049562931 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.049617052 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.050101042 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.050211906 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.050295115 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.050316095 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.050825119 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.050879002 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.050888062 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.050911903 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.050961971 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.054974079 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.055028915 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.055079937 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.055119991 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.055188894 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.055203915 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.055239916 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.055694103 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.055727959 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.055747032 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.058062077 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.058132887 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.058147907 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.058149099 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.058207989 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.058243036 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.058258057 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.058273077 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.058304071 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.058342934 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.058393002 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.059007883 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.059057951 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.059072971 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.059106112 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.059145927 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.059194088 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.066865921 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.066890001 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.066905975 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.066922903 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.066941023 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.066994905 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.067008972 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067024946 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067084074 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.067243099 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067306042 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067346096 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067357063 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.067389965 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067439079 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.067806959 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067845106 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.067897081 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.074707985 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.074726105 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.074781895 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.074805021 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.074836016 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.074860096 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.074887991 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.075030088 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.075052023 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.075089931 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.075599909 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.075618982 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.075671911 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.075731039 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.075778961 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.075814962 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.075835943 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.075875998 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.177643061 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.177772999 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.177824020 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.177830935 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.177858114 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.177890062 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.177906036 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.177922964 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.177962065 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.178097963 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.178149939 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.178181887 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.178194046 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.178302050 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.178334951 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.178352118 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.178368092 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.178406954 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.179173946 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.179208040 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.179240942 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.179248095 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.179337978 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.179372072 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.179384947 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.179406881 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.179455996 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.180042982 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.180095911 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.180129051 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.180140972 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.180255890 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.180288076 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.180304050 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.180322886 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.180367947 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.180982113 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.181032896 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.181070089 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.181083918 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.181206942 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.181238890 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.181253910 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.181273937 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.181313992 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.181951046 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.182001114 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.182034969 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.182043076 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.182176113 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.182209015 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.182220936 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.182244062 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.182286978 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.182913065 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.182992935 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183027029 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183043003 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.183132887 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183166027 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183186054 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.183198929 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183238983 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.183880091 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183932066 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183964968 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.183974981 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.184029102 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.184063911 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.184067965 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.184097052 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.184140921 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.184828997 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.184880018 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.184912920 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.184921026 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.184990883 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.185023069 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.185034037 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.185056925 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.185096979 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.185779095 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.185854912 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.185888052 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.185902119 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.185971975 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186003923 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186012030 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.186037064 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186078072 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.186757088 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186805964 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186839104 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186847925 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.186918020 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186949968 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.186956882 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.186981916 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187021017 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.187587976 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187637091 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187669992 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187676907 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.187825918 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187858105 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187882900 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.187894106 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187926054 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.187932968 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.188631058 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.188666105 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.188684940 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.191879034 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.191929102 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.191934109 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.191961050 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.191998005 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.192070007 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192102909 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192137003 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192142010 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.192171097 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192207098 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192210913 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.192240000 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192274094 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192292929 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.192362070 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192390919 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.192411900 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.245851994 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.282454014 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282500029 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282561064 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282597065 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282630920 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.282632113 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282668114 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282706022 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.282721043 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282754898 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282785892 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282809973 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.282819033 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282870054 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.282870054 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282891989 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.282902956 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282937050 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.282963037 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.282968998 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.283006907 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.283023119 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.283035994 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.283087015 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.452064991 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.457844973 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.457916975 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.463625908 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.710062027 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.710118055 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.710175037 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.710248947 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.710299015 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.710299969 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.710980892 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.711036921 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.711074114 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.711090088 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.712080002 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.712136984 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.712163925 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.712193012 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.712227106 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.712240934 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.713219881 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.713272095 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.713283062 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.713304996 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.713351965 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.714308023 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.714335918 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.714401960 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.714426041 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.714453936 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.714497089 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.715625048 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.715699911 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.715733051 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.715751886 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.716669083 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.716696978 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.716720104 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.716748953 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.716775894 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.716797113 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.717735052 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.717787027 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.717809916 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.717842102 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.717888117 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.718945980 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.719058990 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.719091892 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.719113111 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.719902992 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.719955921 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.719957113 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.719990969 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.720041037 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.720041990 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.721146107 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.721178055 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.721201897 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.721213102 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.721257925 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.722171068 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.722222090 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.722287893 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.722337961 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.722379923 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.722428083 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.723351955 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.723400116 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.723433971 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.723453045 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.723480940 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.723525047 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.724787951 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.724837065 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.724885941 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.724917889 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.724946022 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.724986076 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.725898981 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.725946903 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.725991011 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.725996971 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.726025105 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.726066113 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.727029085 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.776930094 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.803112984 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.808645010 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:37.808703899 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:37.814263105 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:38.077871084 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:38.078023911 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:38.083522081 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:38.174390078 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:38.184592962 CEST	9697	49738	185.196.11.237	192.168.2.4
Oct 26, 2024 07:08:38.184662104 CEST	49738	9697	192.168.2.4	185.196.11.237
Oct 26, 2024 07:08:38.434756994 CEST	49739	443	192.168.2.4	193.149.185.109
Oct 26, 2024 07:08:38.434808969 CEST	443	49739	193.149.185.109	192.168.2.4
Oct 26, 2024 07:08:38.434972048 CEST	49739	443	192.168.2.4	193.149.185.109
Oct 26, 2024 07:08:38.434972048 CEST	49739	443	192.168.2.4	193.149.185.109
Oct 26, 2024 07:08:38.435019016 CEST	443	49739	193.149.185.109	192.168.2.4
Oct 26, 2024 07:08:39.286358118 CEST	443	49739	193.149.185.109	192.168.2.4
Oct 26, 2024 07:08:39.286511898 CEST	49739	443	192.168.2.4	193.149.185.109
Oct 26, 2024 07:08:39.290543079 CEST	49739	443	192.168.2.4	193.149.185.109
Oct 26, 2024 07:08:39.290555954 CEST	443	49739	193.149.185.109	192.168.2.4
Oct 26, 2024 07:08:39.290946960 CEST	443	49739	193.149.185.109	192.168.2.4
Oct 26, 2024 07:08:39.292418003 CEST	49739	443	192.168.2.4	193.149.185.109
Oct 26, 2024 07:08:39.335366964 CEST	443	49739	193.149.185.109	192.168.2.4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	193.149.185.109	443	7760	C:\Windows\System32\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 05:08:39 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2024-10-26 05:08:39 UTC	159	OUT	Data Raw: a1 43 00 a1 53 00 a1 42 ce 67 1c 63 db a1 50 91 86 a1 4e d9 26 7b 45 33 42 39 32 45 41 41 2d 46 35 43 37 2d 34 37 46 38 2d 41 34 38 37 2d 46 34 36 36 46 34 32 30 33 35 41 31 7d a1 44 d9 2a 49 6e 74 65 6c 28 52 29 20 38 32 35 37 34 4c 20 47 69 67 61 62 69 74 20 4e 65 74 77 6f 72 6b 20 43 6f 6e 6e 65 63 74 69 6f 6e a1 41 ab 31 39 32 2e 31 36 38 2e 32 2e 34 a1 4b ad 32 35 35 2e 32 35 35 2e 32 35 35 2e 30 a1 4d c4 06 ec f4 bb ea 15 88 a1 47 ab 31 39 32 2e 31 36 38 2e 32 2e 31 Data Ascii: CSBgcPN&{E3B92EAA-F5C7-47F8-A487-F466F42035A1}D*Intel(R) 82574L Gigabit Network ConnectionA192.168.2.4K255.255.255.0MG192.168.2.1

Target ID:	0
Start time:	01:08:00
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\UGcjMkPWwW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UGcjMkPWwW.exe"
Imagebase:	0x3d0000
File size:	433'152 bytes
MD5 hash:	14988E9D35A0C92435297F7B2821DC60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000000.1707524321.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1742681763.0000000003C00000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.1740844173.00000000003C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1742866792.0000000003E20000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.1743471717.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:08:04
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\OpenWith.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0xf20000
File size:	107'368 bytes
MD5 hash:	0ED31792A7FFF811883F80047CBCFC91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000003.1743648406.0000000000C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000003.1768649425.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000003.1745436761.0000000005180000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000003.1745270453.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000002.1827092674.00000000046E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:08:12
Start date:	26/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff6d7750000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1901618122.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1900288624.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2116742078.00000251D5511000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1906943216.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1900970366.00000251D50F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1904033708.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1902184169.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1903499792.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1905062934.00000251D50FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1900141786.00000251D50F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1903745557.00000251D50FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.1876203189.00000251D5311000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.1876369505.00000251D53C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1901371041.00000251D50FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:08:33
Start date:	26/10/2024
Path:	C:\Program Files\Windows Media Player\wmlaunch.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmlaunch.exe"
Imagebase:	0x7ff6889f0000
File size:	96'256 bytes
MD5 hash:	836F3636C231980EAD81C84BCA55D82B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	01:08:36
Start date:	26/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	1667
Total number of Limit Nodes:	20

Executed Functions

Function 00424E5A Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 89
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,3B9ACA00), ref: 00424E6D
RtlAllocateHeap.NTDLL(00000000), ref: 00424E74
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00424EA5
_wcsrchr.LIBVCRUNTIME ref: 00424EB8
lstrlenW.KERNEL32(-00000002), ref: 00424EDD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00424F14
RtlFreeHeap.NTDLL(00000000), ref: 00424F1B
MulDiv.KERNEL32(00000001,80000000,80000000), ref: 00424F30

Strings

(, xrefs: 00424EFF
, xrefs: 00424EFA
@, xrefs: 00424F04

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateFileFreeModuleName_wcsrchrlstrlen
String ID: $($@
API String ID: 443335681-2581157662
Opcode ID: 4a6969c73fee2ab16a73259faee53858f3156e4df1be3dd813d1fec864c14037
Instruction ID: be5ef30631018e73b40bebf3ab7c204a3c001e642ca1778efa1ff50b2a995815
Opcode Fuzzy Hash: 4a6969c73fee2ab16a73259faee53858f3156e4df1be3dd813d1fec864c14037
Instruction Fuzzy Hash: 36212C75700320AEE7305764BE4DF6B669CDBC5355F920027F605E76D1DAA88C40C57D

Function 0042C146 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,0042C255,0042CAD9,?,00000000,00000000,00000000,?,0042C3CE,00000022,FlsSetValue,00444078,00444080,00000000), ref: 0042C207

Strings

ext-ms-, xrefs: 0042C1B1
api-ms-, xrefs: 0042C19D

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ebffaa51a5fc76d1492a932055384fad9e2e10e731ada237fc40a0002bdefe5e
Instruction ID: 1f77fc81c0a68ee6f3138aed61358145f6b83d7b6bac0c9dc03c5386dc0e7d78
Opcode Fuzzy Hash: ebffaa51a5fc76d1492a932055384fad9e2e10e731ada237fc40a0002bdefe5e
Instruction Fuzzy Hash: D2210B35B40120EBD7219B60BC82A6F3769EF42760FA00122FD11E7381DB74EE10CAE9

Function 004322CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00432314

Part of subcall function 00432098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004320C1
Part of subcall function 00432098: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0043226D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00432366
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 004323C0
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004323F3

Strings

,, xrefs: 00432344

Memory Dump Source

Source File: 00000000.00000003.1740948671.0000000000432000.00000040.00000001.01000000.00000003.sdmp, Offset: 00432000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_432000_UGcjMkPWwW.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction ID: a9b97ab7347ca5250ebf2a160aa0c7214d6c775a5c1ad3215425b97944af8a4a
Opcode Fuzzy Hash: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction Fuzzy Hash: B251F875900709AFCB10DFA9C981B9EBBF4FF08354F10951AFA59A7240D3B4E954CBA4

Function 004322CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00432314

Part of subcall function 00432098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004320C1
Part of subcall function 00432098: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0043226D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00432366
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 004323C0
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004323F3

Strings

,, xrefs: 00432344

Memory Dump Source

Source File: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction ID: a9b97ab7347ca5250ebf2a160aa0c7214d6c775a5c1ad3215425b97944af8a4a
Opcode Fuzzy Hash: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction Fuzzy Hash: B251F875900709AFCB10DFA9C981B9EBBF4FF08354F10951AFA59A7240D3B4E954CBA4

Function 00428946 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00428A50,?,00428940,00000000,?,?,00428A50,AE31545A,?,00428A50), ref: 00428957
TerminateProcess.KERNEL32(00000000,?,00428940,00000000,?,?,00428A50,AE31545A,?,00428A50), ref: 0042895E
ExitProcess.KERNEL32 ref: 00428970

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 6d1fd4b71a87ec7b3170e5586050a54d9791563e93a0dfb0b18a49865d4309d6
Instruction ID: 808adf8508e72cc70fe1fc9dd0a8f5738e002ca5ec64e5c93cb8472c025b5a26
Opcode Fuzzy Hash: 6d1fd4b71a87ec7b3170e5586050a54d9791563e93a0dfb0b18a49865d4309d6
Instruction Fuzzy Hash: 3BD05E71001214BFCF002F61ED0D96E3F66AF01344B804029BA0885031CF758881CA8D

Function 00432098 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004320C1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0043226D

Memory Dump Source

Source File: 00000000.00000003.1740948671.0000000000432000.00000040.00000001.01000000.00000003.sdmp, Offset: 00432000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_432000_UGcjMkPWwW.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 1d1c6bacfa6552b53e9476c3e2734ff818dc263eff0a877855a85f09b318e423
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: FF719C71A04249DFDB41CF98CA81BEEBBF0BB09314F245096E565F7241C278AA81DF69

Function 00432098 Relevance: 2.7, APIs: 2, Instructions: 163
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004320C1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0043226D

Memory Dump Source

Source File: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 1d1c6bacfa6552b53e9476c3e2734ff818dc263eff0a877855a85f09b318e423
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: FF719C71A04249DFDB41CF98CA81BEEBBF0BB09314F245096E565F7241C278AA81DF69

Function 0042C211 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706acf719c5e72759b301f4d816fb17e51d545d9e6e5775b29a5cf0ab82d4473
Instruction ID: cf0c724444a35943ec148e7efeaf846af75bfe3e4fd878de668fcd38a5d9cb5e
Opcode Fuzzy Hash: 706acf719c5e72759b301f4d816fb17e51d545d9e6e5775b29a5cf0ab82d4473
Instruction Fuzzy Hash: D901D6377002309B9B218FE9FCC196B3365ABC63207604166F90497154DE359C45A7AD

Non-executed Functions

Function 004255A9 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004255B5
IsDebuggerPresent.KERNEL32 ref: 00425681
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004256A1
UnhandledExceptionFilter.KERNEL32(?), ref: 004256AB

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d07516bcd21c32ed5460a08b7b444bc6836ac26712ed709662b82df8d9590281
Instruction ID: fa5087e94c73491df1197bb193d4d4cc3487b3ee9e68a0fe906e4cbde15661b4
Opcode Fuzzy Hash: d07516bcd21c32ed5460a08b7b444bc6836ac26712ed709662b82df8d9590281
Instruction Fuzzy Hash: E6313C75D01328DBDB10DF60D989BCDBBF8AF04304F5040AAE40DA7250EB749A84CF48

Function 00429AB4 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00429BAC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00429BB6
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00429BC3

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9a5ae9b1e05cc60b6f2d641c3970c8e45f75c7d52e2c438701dbd461c97d5e36
Instruction ID: 1264163af521f070e0aeb0a43a900b2aa2259b27ce75f0fe6d77f0f388f04414
Opcode Fuzzy Hash: 9a5ae9b1e05cc60b6f2d641c3970c8e45f75c7d52e2c438701dbd461c97d5e36
Instruction Fuzzy Hash: BD31C6749012289BCB21DF65E98978DBBB8BF08314F9041EAE80CA7250E7749F85CF58

Function 00430BC1 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00430BBC,?,?,00000008,?,?,004307BF,00000000), ref: 00430DEE

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6e649662780a3af17f838e288bea4e27905cf2cec2d49001a490b4225a6890df
Instruction ID: b76e54958b890168b6281f8095d1dc1cd3988fc868d0e6cd58f8f58df6203020
Opcode Fuzzy Hash: 6e649662780a3af17f838e288bea4e27905cf2cec2d49001a490b4225a6890df
Instruction Fuzzy Hash: 8DB16D31610608CFD719CF28C496B657BE0FF49364F299659E89ACF3A1C339E992CB44

Function 00425845 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0042585B

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a922d18238b6887ff41489d84f11fd925fe743140e25d338ba365e1dc67a5c98
Instruction ID: 2dcea7eb3f4219241086307f8de7357b35c61acbe6daa653289a9727ab7ffc44
Opcode Fuzzy Hash: a922d18238b6887ff41489d84f11fd925fe743140e25d338ba365e1dc67a5c98
Instruction Fuzzy Hash: 27518BB1A116258BEB28CF59E8827ABBBF0FB49310F14892AC405EB350D379DD40DF58

Function 00432277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1740948671.0000000000432000.00000040.00000001.01000000.00000003.sdmp, Offset: 00432000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_432000_UGcjMkPWwW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 51dccf1c194d7b069ec4781486d2ceab18fb31f6958312bee16b600ab04a859d
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 3DF06D79A00210CF8B24CF49DA48C97B7F6FB89720B6555E6E4049B321D3F8ED45CBA5

Function 00432277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 51dccf1c194d7b069ec4781486d2ceab18fb31f6958312bee16b600ab04a859d
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 3DF06D79A00210CF8B24CF49DA48C97B7F6FB89720B6555E6E4049B321D3F8ED45CBA5

Function 004272D1 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 004273F0
___TypeMatch.LIBVCRUNTIME ref: 004274FE
CatchIt.LIBVCRUNTIME ref: 0042754F
_UnwindNestedFrames.LIBCMT ref: 00427650
CallUnexpected.LIBVCRUNTIME ref: 0042766B

Strings

lmD, xrefs: 004273E7
csm, xrefs: 00427427
csm, xrefs: 0042737B
csm, xrefs: 0042730E

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$lmD
API String ID: 4119006552-827323207
Opcode ID: c899ba6b0d738f2517bab08d06f3900dbdfe424a19a2c780e06e3e91c03e1b23
Instruction ID: 42c92b99c1a643d3c6d44ac7a2922c8e103c21cb66584a050499088af8400460
Opcode Fuzzy Hash: c899ba6b0d738f2517bab08d06f3900dbdfe424a19a2c780e06e3e91c03e1b23
Instruction Fuzzy Hash: ECB19F71A04229EFCF24DFA5E8419AEBB75FF04314B94459BE8006B302D739DA51CF99

Function 004263D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 00426407
___except_validate_context_record.LIBVCRUNTIME ref: 0042640F
_ValidateLocalCookies.LIBCMT ref: 00426498
__IsNonwritableInCurrentImage.LIBCMT ref: 004264C3
_ValidateLocalCookies.LIBCMT ref: 00426518

Strings

csm, xrefs: 004264AD
eUB, xrefs: 004264DC

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$eUB
API String ID: 1170836740-2481692299
Opcode ID: 74915bb8a68f282e7ffd95cbd81a69712ea3092acfb389c882bf03107c2d9937
Instruction ID: cbd224f3955dfe1ff9b6cf5edf2743e978bc78bda04d7a4e03515c55052f784d
Opcode Fuzzy Hash: 74915bb8a68f282e7ffd95cbd81a69712ea3092acfb389c882bf03107c2d9937
Instruction Fuzzy Hash: 5641D734B002649BCF10EF69D841A9E7BB4BF05318F95809BE8145B352D779EE05CB98

Function 00428990 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AE31545A,?,?,00000000,004314CF,000000FF,?,0042896C,00428A50,?,00428940,00000000), ref: 004289C5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004289D7
FreeLibrary.KERNEL32(00000000,?,?,00000000,004314CF,000000FF,?,0042896C,00428A50,?,00428940,00000000), ref: 004289F9

Strings

eUB, xrefs: 004289E8
mscoree.dll, xrefs: 004289BE
CorExitProcess, xrefs: 004289CF

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$eUB$mscoree.dll
API String ID: 4061214504-1419635457
Opcode ID: 029d5685d3954f57eac01f59dc558c51f75b40cd36c83bcdcb9b9ec749be6049
Instruction ID: 28ef91845ba615b6821bcf1f0dff294df6d1a62ebeca2698181fa43b94decb8d
Opcode Fuzzy Hash: 029d5685d3954f57eac01f59dc558c51f75b40cd36c83bcdcb9b9ec749be6049
Instruction Fuzzy Hash: 1801A776A50625AFDB258F40DD05BAF7BF9FB04710F40062AF911A2290DFB89940CB48

Function 00426921 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00426918,0042674C,0042578C), ref: 0042692F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0042693D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00426956
SetLastError.KERNEL32(00000000,00426918,0042674C,0042578C), ref: 004269A8

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d029989aa53804120328c31175eda8f23931a7bc88744946d9017036b4507509
Instruction ID: 56b5dd0bef56fe4180834679e993d1ca8bec630c66bf609ed1d707c677ae55de
Opcode Fuzzy Hash: d029989aa53804120328c31175eda8f23931a7bc88744946d9017036b4507509
Instruction Fuzzy Hash: CE01D8B77093325EAA282B7ABC9562766A4DB06778761023FF120451E0EF6D4C51E14C

Function 0042707A Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00427141
___AdjustPointer.LIBCMT ref: 00427164
___AdjustPointer.LIBCMT ref: 00427200

Strings

eUB, xrefs: 004270D9

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: eUB
API String ID: 1740715915-3997391220
Opcode ID: 632423e69c114c35bb1f4a699fccf7858217b78447d18c7da5d2dc1338dff0e7
Instruction ID: f28080893e5777fedc371b4c931780b0fb60f5d99e3e5f5d80e6dfac6ae781a5
Opcode Fuzzy Hash: 632423e69c114c35bb1f4a699fccf7858217b78447d18c7da5d2dc1338dff0e7
Instruction Fuzzy Hash: 7E51CF71709622AFEB288F51F841B7B77A5EF40304F94452FE801473A1E739ACA4C7A8

Function 0042A6EB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\UGcjMkPWwW.exe, xrefs: 0042A707

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\UGcjMkPWwW.exe
API String ID: 0-3717239802
Opcode ID: aa35fc46445b2cbf1722f12c737f62f15449847a2fdd5f02eaec3c81865b653b
Instruction ID: 9a5f2fff47c571f02d64de571845fab174efbf07e347b44596d07a3f04ba9351
Opcode Fuzzy Hash: aa35fc46445b2cbf1722f12c737f62f15449847a2fdd5f02eaec3c81865b653b
Instruction Fuzzy Hash: 3B219535700625BFDB10AF62EC8092B77B8AF80369B90452BFD15D7251D738EC2097AE

Function 00427676 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0042769B
CatchIt.LIBVCRUNTIME ref: 00427781

Strings

MOC, xrefs: 004276AD
RCC, xrefs: 004276B5

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 31e887f66186c2f0197da911b521aaeb19d1b825478213455f43e1c3360e8274
Instruction ID: 8e8a16073f02f2d35a0acf408d1116429337cbafd957c9d609090b98aabe8d57
Opcode Fuzzy Hash: 31e887f66186c2f0197da911b521aaeb19d1b825478213455f43e1c3360e8274
Instruction Fuzzy Hash: 02419C71A00119AFDF15DF98ED81EEE7BB5FF48304F64809AF904A7211D339A950DB58

Function 00426B43 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00426AF4,00000000,?,00449C78,?,?,?,00426C97,00000004,InitializeCriticalSectionEx,00442CC0,InitializeCriticalSectionEx), ref: 00426B50
GetLastError.KERNEL32(?,00426AF4,00000000,?,00449C78,?,?,?,00426C97,00000004,InitializeCriticalSectionEx,00442CC0,InitializeCriticalSectionEx,00000000,?,00426A17), ref: 00426B5A
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00426B82

Strings

api-ms-, xrefs: 00426B67

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 04d1a227f8592f0f36f58b166f6e8ea8f273836b90f847e668ea6642503f347e
Instruction ID: d8b2cf26f80f7b18f511fb70c89a3b3d198aab723c8060b7f01e79de32ddc76d
Opcode Fuzzy Hash: 04d1a227f8592f0f36f58b166f6e8ea8f273836b90f847e668ea6642503f347e
Instruction Fuzzy Hash: 53E04F30780214FBEF201BA1FD06F5A3EA5AF11B55FA04031FA0DE91E1DBA6E950C95D

Function 0042DF81 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AE31545A,00000000,00000000,?), ref: 0042DFE4

Part of subcall function 0042B2B9: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0042DC5F,?,00000000,-00000008), ref: 0042B31A

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0042E236
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0042E27C
GetLastError.KERNEL32 ref: 0042E31F

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7c78c18f2f6d27d93736e830757c9050804cdca91c7b0fa199330a3b779d4dc9
Instruction ID: 397b5744dc7c01f9b81ba8a0b7f648e55679691bae4bc1c5111e6adcb4fb97c4
Opcode Fuzzy Hash: 7c78c18f2f6d27d93736e830757c9050804cdca91c7b0fa199330a3b779d4dc9
Instruction Fuzzy Hash: DDD1AF75E00268DFCB15CFA9E8809EEBBB4FF09304F58416AE956EB351D634AD02CB54

Function 00429F05 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0042B2B9: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0042DC5F,?,00000000,-00000008), ref: 0042B31A

GetLastError.KERNEL32 ref: 00429F69
__dosmaperr.LIBCMT ref: 00429F70
GetLastError.KERNEL32(?,?,?,?), ref: 00429FAA
__dosmaperr.LIBCMT ref: 00429FB1

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 082dc66e4fbf717edbe3b8d6a88fe0012bc2c8d417f8efd6154159dfc7aafffc
Instruction ID: 9cd7c7b3116b686667c183bae5f9e1aa89debd366cfd8112480beadb1d04cde6
Opcode Fuzzy Hash: 082dc66e4fbf717edbe3b8d6a88fe0012bc2c8d417f8efd6154159dfc7aafffc
Instruction Fuzzy Hash: CD21C831704635AFDB50AF62E98096BB7A9EF00368F81852FF919D7200D738EC508759

Function 0042B35C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0042B364

Part of subcall function 0042B2B9: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0042DC5F,?,00000000,-00000008), ref: 0042B31A

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042B39C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042B3BC

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 66ad459253cfc935fcf3dd62c29a64a44d8f69eae4986219932ecdd20693aa94
Instruction ID: d0abd4c918b4875348a2a3da25587772f2f57c447c300400ad91dc4316027fd6
Opcode Fuzzy Hash: 66ad459253cfc935fcf3dd62c29a64a44d8f69eae4986219932ecdd20693aa94
Instruction Fuzzy Hash: 5111A1B6705635BF6611A7727CCDD7F6A6CCE453A8791002AF901A1201EFA8DD0182F9

Function 0042F756 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0042EF14,00000000,00000001,00000000,?,?,0042E373,?,00000000,00000000), ref: 0042F76D
GetLastError.KERNEL32(?,0042EF14,00000000,00000001,00000000,?,?,0042E373,?,00000000,00000000,?,?,?,0042E916,00000000), ref: 0042F779

Part of subcall function 0042F73F: CloseHandle.KERNEL32(FFFFFFFE,0042F789,?,0042EF14,00000000,00000001,00000000,?,?,0042E373,?,00000000,00000000,?,?), ref: 0042F74F

___initconout.LIBCMT ref: 0042F789

Part of subcall function 0042F701: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0042F730,0042EF01,?,?,0042E373,?,00000000,00000000,?), ref: 0042F714

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0042EF14,00000000,00000001,00000000,?,?,0042E373,?,00000000,00000000,?), ref: 0042F79E

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 159a020eca81b7e527a1eb7b2f18453f01339d408ffdf505323da284aeb4e3f4
Instruction ID: e7c4429fde62967a16863e015506391a56bad62625ccec9f9240a8f05a8a0e82
Opcode Fuzzy Hash: 159a020eca81b7e527a1eb7b2f18453f01339d408ffdf505323da284aeb4e3f4
Instruction Fuzzy Hash: A2F0C73A511129BBCF122FD6EC04E9B3F76FF463A1B954435FA1895230C6728C24DB98

Function 004302B3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042FC1F), ref: 004302CC

Strings

tcD, xrefs: 00430461
eUB, xrefs: 00430396, 00430440, 00430486

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: eUB$tcD
API String ID: 3527080286-2036034393
Opcode ID: 5f4e5c8b7e88d1cc567b515e22c0d42db2be24567f4fd25027bdae07b30c8691
Instruction ID: 1109ff3070e9ab034d1f99b9461635cd92766f9374cd271834475795bb9484a6
Opcode Fuzzy Hash: 5f4e5c8b7e88d1cc567b515e22c0d42db2be24567f4fd25027bdae07b30c8691
Instruction Fuzzy Hash: 6F51BF7090060ACBDF108F58E86C1AEBB70FF0E300F515257D981A7264CB7C8A65CB5E

Function 00427F46 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,00000004,?,?,00000000,00000000,00000004,00427670,00000000), ref: 00427FA6

Strings

pvB, xrefs: 00427F4C
eUB, xrefs: 00427F76

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID: eUB$pvB
API String ID: 3997070919-2693038244
Opcode ID: 1e4afb778578ad3913132c06e46d8728d4392a6842548b4f9d073f500c4dc1fe
Instruction ID: 2796cc4bab5a1890bdbccac4bcd3f6d5321af1687e4df1d58257056d58e9a9c1
Opcode Fuzzy Hash: 1e4afb778578ad3913132c06e46d8728d4392a6842548b4f9d073f500c4dc1fe
Instruction Fuzzy Hash: 8F01A776B04218ABCB059F59DA40B9EBBB9FF48704F55405AE9059B3A0D774DD00CBD0

Function 0042C3F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 0042C434

Strings

InitializeCriticalSectionEx, xrefs: 0042C404
eUB, xrefs: 0042C424

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$eUB
API String ID: 2593887523-3452185082
Opcode ID: 3718dd1ee9f2642713c8738bb8712c0e22e7195d3b4ae32ffbd86dc565bc3811
Instruction ID: f9a2d2a80f7e2f66783eb26b027e1c9071712ea0d40ba1bb39305f81837caad6
Opcode Fuzzy Hash: 3718dd1ee9f2642713c8738bb8712c0e22e7195d3b4ae32ffbd86dc565bc3811
Instruction Fuzzy Hash: DBE09235680228B7DF212F81ED06F9F7F12EB54B61B908022FE1916160CAB54920E7D8

Function 0042C2F5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0042C329

Strings

FlsAlloc, xrefs: 0042C305
eUB, xrefs: 0042C31F

Memory Dump Source

Source File: 00000000.00000002.1744147121.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.1744136478.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744181306.0000000000432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744193812.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744205124.0000000000449000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1744217355.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_UGcjMkPWwW.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$eUB
API String ID: 2773662609-4175585831
Opcode ID: 0b5146336f4cacc3e6d64e048c7cbdf8463e2b4b43b6eaefa384f518ba9f0be9
Instruction ID: b9d0f37efbb107baf2aa6f6089a30300c236fca2691ab903e8f09426f1877535
Opcode Fuzzy Hash: 0b5146336f4cacc3e6d64e048c7cbdf8463e2b4b43b6eaefa384f518ba9f0be9
Instruction Fuzzy Hash: E6E0C23ABC0338B39A2023916E0AB9E7D44CBD9B60BD00033FF05662519EE90D1182DE

Analysis Process: OpenWith.exePID: 7316, Parent PID: 5772COMMON

Executed Functions

Function 00AF02D8 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 169memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00AF0326

Part of subcall function 00AF00A4: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 00AF00CD
Part of subcall function 00AF00A4: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00AF0279

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00AF0378
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 00AF03E7
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00AF0407
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 00AF042E
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00AF0456
CloseHandle.KERNELBASE(?), ref: 00AF0471

Strings

,, xrefs: 00AF0356

Memory Dump Source

Source File: 00000001.00000003.1743747061.0000000000AF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_af0000_OpenWith.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 34919759cab89c45596a3336aca0d90db3a2564f30e7825e5c793611e7351f71
Instruction ID: 8542271ced93e057b65a52cb377c174c8eaaa89f2b41a4a7f862530d66377e1c
Opcode Fuzzy Hash: 34919759cab89c45596a3336aca0d90db3a2564f30e7825e5c793611e7351f71
Instruction Fuzzy Hash: 8A610DB5900209EFDB20DFA5C984EEEBBB9FF08355F148529FA59A7241D730E940CB60

Function 00AF00A4 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 00AF00CD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00AF0279

Memory Dump Source

Source File: 00000001.00000003.1743747061.0000000000AF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_af0000_OpenWith.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 5ae9d0a91a08e571b56469c844824b11357c7538125900eb9c4738f692f790c5
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: 1A718A71A0424ADFDB41CF98C985BEDBBF0AB19314F244095E665FB242C334AA91DF64

Analysis Process: OpenWith.exePID: 7404, Parent PID: 5772COMMON

Execution Graph

Execution Coverage:	34.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	71.4%
Total number of Nodes:	28
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007DF40154B498 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 544nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154B56E
calloc.MSVCRT ref: 00007DF40154B58B
DuplicateHandle.KERNELBASE ref: 00007DF40154B620
NtAcceptConnectPort.NTDLL ref: 00007DF40154B6CB
NtAcceptConnectPort.NTDLL ref: 00007DF40154B724
NtAcceptConnectPort.NTDLL ref: 00007DF40154B763
NtAcceptConnectPort.NTDLL ref: 00007DF40154B7AA
NtAcceptConnectPort.NTDLL ref: 00007DF40154B7E7
NtAcceptConnectPort.NTDLL ref: 00007DF40154B86D
NtAcceptConnectPort.NTDLL ref: 00007DF40154B8CC
NtAcceptConnectPort.NTDLL ref: 00007DF40154B9B2
NtAcceptConnectPort.NTDLL ref: 00007DF40154B9EC
NtAcceptConnectPort.NTDLL ref: 00007DF40154BA19

Strings

H, xrefs: 00007DF40154B94F
,, xrefs: 00007DF40154B59E
H, xrefs: 00007DF40154B934

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$DuplicateHandlecalloc
String ID: ,$H$H
API String ID: 2577638757-438696205
Opcode ID: 9fb62eb4d8959293fc2d40b19de36242d3d29fe68d1ba52932dcd9bec1ad6912
Instruction ID: fe1d2aaf624d3f916c827d0e42b60fda91d129a6964930caacbb8d4a3476f17d
Opcode Fuzzy Hash: 9fb62eb4d8959293fc2d40b19de36242d3d29fe68d1ba52932dcd9bec1ad6912
Instruction Fuzzy Hash: D302B63061CA989FE768DF58D8856AAB3E0FBD8305F10453ED58FD32A4DA74E5418B82

Function 00007DF40154BCC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154BD8F
NtAcceptConnectPort.NTDLL ref: 00007DF40154BE50
free.MSVCRT ref: 00007DF40154BE55

Strings

, xrefs: 00007DF40154BD7F
@, xrefs: 00007DF40154BD48
0, xrefs: 00007DF40154BD32

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$free
String ID: $0$@
API String ID: 2328307678-2347541974
Opcode ID: d8fdb236a247b9205c502de8d0d979f89367b2180e7993cbf521bb03780d7e1e
Instruction ID: c213447563354f977a2d819e0af72cddb9327ba73a9f1a51eae49336d58fd604
Opcode Fuzzy Hash: d8fdb236a247b9205c502de8d0d979f89367b2180e7993cbf521bb03780d7e1e
Instruction Fuzzy Hash: 6651913052C7989FE768DF28D4857AA77E0FBC9304F10452EE58EC6255DB74E4858B83

Function 00007DF40154BE6C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 158nativeCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF40154BE8D
NtAcceptConnectPort.NTDLL ref: 00007DF40154BF3A

Strings

0, xrefs: 00007DF40154BED8
, xrefs: 00007DF40154BF2A
@, xrefs: 00007DF40154BEEE

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPortcalloc
String ID: $0$@
API String ID: 2195583734-2347541974
Opcode ID: e038bc6975502a75aa15522c9d2aad796b46013016ac9629b0cf3dc02c1d6b17
Instruction ID: cc0a70444962959a889a1e476339f43f4decef05f8b6c46bb5512655ebdb4325
Opcode Fuzzy Hash: e038bc6975502a75aa15522c9d2aad796b46013016ac9629b0cf3dc02c1d6b17
Instruction Fuzzy Hash: 1B51393060DB899FE764DF689484BABB7E4EBD8304F10492EE48EC7264EB75D4448B42

Function 00000251D31030C7 Relevance: 7.9, APIs: 5, Instructions: 390nativememoryCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00000251D3103957
NtAcceptConnectPort.NTDLL ref: 00000251D31039E4
NtAcceptConnectPort.NTDLL ref: 00000251D3103AA3
RtlFreeHeap.NTDLL ref: 00000251D3103AC0
RtlFreeHeap.NTDLL ref: 00000251D3103AD2

Memory Dump Source

Source File: 00000002.00000003.1863513864.00000251D3100000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_251d3100000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$FreeHeap
String ID:
API String ID: 2519882481-0
Opcode ID: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction ID: 0a80a119d72a29b6e99fbcb0e0e143e0b5d7fbe4979e3f6201f0b0c3e15f97d8
Opcode Fuzzy Hash: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction Fuzzy Hash: 35C17730218F198FDB68EF18D489B69B7F1FB98311F004A5EE48AC7256DB34E855C785

Function 00007DF401541B18 Relevance: 4.6, APIs: 3, Instructions: 110pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNELBASE ref: 00007DF401541BCF
BindIoCompletionCallback.KERNEL32 ref: 00007DF401541C06
ConnectNamedPipe.KERNELBASE ref: 00007DF401541C17

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: NamedPipe$BindCallbackCompletionConnectCreate
String ID:
API String ID: 2502124517-0
Opcode ID: 584620923d8bee05c4cd2b55fbc688861300e251001a2660cae9de72a1f183dd
Instruction ID: 0e05f1c5d55cf197bb3a57d6c20ea3f8321c081e39d8bb1db0a9ea4ff9119c3a
Opcode Fuzzy Hash: 584620923d8bee05c4cd2b55fbc688861300e251001a2660cae9de72a1f183dd
Instruction Fuzzy Hash: E0319370608A488FE794DF28D8D875A77F1FB94314F10462AD05BC71E4DF78D8858B81

Function 00007DF40154C7CC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF40154C82B

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d4dd2c9ec2e40b847152b417cb6d645fdeafd31ca8a11a7a04321dd5438b40c0
Instruction ID: d9dfb4c577e226ed1c7cfff61b9e7e05f76f438294cab3f493f0f89ac4c7569c
Opcode Fuzzy Hash: d4dd2c9ec2e40b847152b417cb6d645fdeafd31ca8a11a7a04321dd5438b40c0
Instruction Fuzzy Hash: EA21D131B0DA989FF754DF68888476A72E1FBC8329F50053FE44AD72A4D638A8848741

Function 00007DF40154C70C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF40154C764

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 47ebd45c6b9b16ee77b28bcb10b07460bf5cba96d3288197dd2caf634787b8b3
Instruction ID: 903ce8b6164edacbfdfd80b8d64c92429498e352d3cd656fcb93743660253014
Opcode Fuzzy Hash: 47ebd45c6b9b16ee77b28bcb10b07460bf5cba96d3288197dd2caf634787b8b3
Instruction Fuzzy Hash: 6A21C031B0D9985FF750DE98888866B72F0EBD8309F60053FE50ED7264D738A9848781

Function 00007DF401522634 Relevance: 3.3, APIs: 2, Instructions: 293threadinjectionCOMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007DF40152273A
SuspendThread.KERNELBASE ref: 00007DF40152277C

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: CloseHandleSuspendThread
String ID:
API String ID: 1038686644-0
Opcode ID: ee8ed1484b309d5b480d9ed41d064abcb8b4e034361352156597246fbc6f772d
Instruction ID: f64a02280bb4759af45628a893726e857dc9e1c1c745d9c2f50662b6f6453a7c
Opcode Fuzzy Hash: ee8ed1484b309d5b480d9ed41d064abcb8b4e034361352156597246fbc6f772d
Instruction Fuzzy Hash: BF91E636A0C6555BFB689B18C89517A73F1FF86310F18417EE04FDB5A9CA78E842CB81

Function 00000251D3091CD0 Relevance: 3.3, APIs: 2, Instructions: 278
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 00000251D3091F6E
CloseHandle.KERNELBASE ref: 00000251D3091F77

Memory Dump Source

Source File: 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_251d3090000_OpenWith.jbxd

Similarity

API ID: AcceptCloseConnectHandlePort
String ID:
API String ID: 3811980168-0
Opcode ID: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction ID: fd970a71fce9f8b7fc077457e626cea0c20dcd64fae316e11db11941cf23f752
Opcode Fuzzy Hash: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction Fuzzy Hash: 7191F830619E088FDB69EF1CC8857E573F0FB88311F18465EE49BC3296DA34A952CB95

Function 00007DF4015222DC Relevance: 3.2, APIs: 2, Instructions: 222memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 00007DF4015222F4
VirtualAlloc.KERNELBASE ref: 00007DF4015223C0

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 10974d638571623cb466fc5259723849182c6a649d453933aa228a33d07da908
Instruction ID: a891658c94f7e12533f093b819222b27fee7c8f7b80c90d1233754478658b840
Opcode Fuzzy Hash: 10974d638571623cb466fc5259723849182c6a649d453933aa228a33d07da908
Instruction Fuzzy Hash: 3851D53261CE5D4FF755EA6C944877A72E1FBE9300F14013AD44ED71A9EA78E88187C1

Function 00000251D3090AC8 Relevance: 3.2, APIs: 2, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 00000251D3090BFD
NtAcceptConnectPort.NTDLL ref: 00000251D3090C47

Memory Dump Source

Source File: 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_251d3090000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction ID: e9c0014af654e59df3f4ad61fe057e6a4cb659c87e4ea3675e7aa0d25e0232aa
Opcode Fuzzy Hash: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction Fuzzy Hash: 5B416F34A28E140AEB28E72C8C9A73977E2F7C530AF34855EE0E6C2192D539C5438755

Function 00000251D3091A90 Relevance: 3.2, APIs: 2, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 00000251D3091AD5

Part of subcall function 00000251D309185C: GetProcessMitigationPolicy.KERNELBASE ref: 00000251D309192F

NtAcceptConnectPort.NTDLL ref: 00000251D3091BCF

Memory Dump Source

Source File: 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_251d3090000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$MitigationPolicyProcess
String ID:
API String ID: 2923266908-0
Opcode ID: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction ID: 992ab11a7e6fb02eafd2740d6736b35826d2395a6c3d76d19336f5eb773c9331
Opcode Fuzzy Hash: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction Fuzzy Hash: 3B41CF30218F488FDB48DF2C98897967BD1EB59320F0443AEE85ACB2D7DA34D915C795

Function 00007DF401574088 Relevance: 3.1, APIs: 2, Instructions: 93networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF4015741A9), ref: 00007DF4015740B5

Part of subcall function 00007DF401573C98: ioctlsocket.WS2_32 ref: 00007DF401573CC4

bind.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF4015741A9), ref: 00007DF40157413A

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: bindioctlsocketsocket
String ID:
API String ID: 3555158474-0
Opcode ID: 1cbeedcb49cdd83f56073e3a9aa9cf65c2d138516cd5c7d59cce1983b39e0131
Instruction ID: 9d515b3d4cd54ac23dc40b7dafdc6dd3692b0535b325da26656e76e9f4a982c2
Opcode Fuzzy Hash: 1cbeedcb49cdd83f56073e3a9aa9cf65c2d138516cd5c7d59cce1983b39e0131
Instruction Fuzzy Hash: 7221EC307189444FFB48AF34F88EA6633E1EB95325F10067AD82FDB2E9EE249C014651

Function 00007DF40154D2F4 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154D361
NtAcceptConnectPort.NTDLL ref: 00007DF40154D3B8

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 98531d878e0ad7d3d6690ce9736b63ba0a61470b6d8d195234036ffb9fe9491b
Instruction ID: 95cc187c82cfb1cb87771099ba14c09fc47a00788a0d2c3c985d35e4f3ab924a
Opcode Fuzzy Hash: 98531d878e0ad7d3d6690ce9736b63ba0a61470b6d8d195234036ffb9fe9491b
Instruction Fuzzy Hash: 7C214F3051CA488FEB49EB58D888B6673F1FBAC345F00452AE44AC72B4DBB4E984CB41

Function 00007DF40154D3C0 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154D42D
NtAcceptConnectPort.NTDLL ref: 00007DF40154D481

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 9166209b5f367574360b80d64ced2ea26e8fa752ef609ccd6263efb912702e76
Instruction ID: ea8668ac63a458f319090d380498ebce4367c1f0d509eed116f6e9b58125b68f
Opcode Fuzzy Hash: 9166209b5f367574360b80d64ced2ea26e8fa752ef609ccd6263efb912702e76
Instruction Fuzzy Hash: A021623060CA588FEB54EF58D848BA673F1FBE9345F00052EE44AC72A0DBB4E884CB41

Function 00007DF40154C47C Relevance: 1.8, APIs: 1, Instructions: 260nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154C53C

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1a40425d81a0dda3cd82788b19327da5a379df3b5c3bd351d49e58af76a5eeec
Instruction ID: eedbfd8e295b0564d805468fe0cef401ebc7bb131eb016f3eaef672b40ca5517
Opcode Fuzzy Hash: 1a40425d81a0dda3cd82788b19327da5a379df3b5c3bd351d49e58af76a5eeec
Instruction Fuzzy Hash: 7B81A530A1DB999BF7649A5894446AFB3E0FFD4304F50853BE44FDB2A4DB78F8408681

Function 00007DF401574520 Relevance: 1.7, APIs: 1, Instructions: 167networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF4015745BF

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 7916fdf4d3e942b440d7f5c412e90116e139ebed5d60f444feec34680a904e5a
Instruction ID: f51eaca0710b37e023acc313cab9157df224d3b1be51bc42172b6b2b656b71f0
Opcode Fuzzy Hash: 7916fdf4d3e942b440d7f5c412e90116e139ebed5d60f444feec34680a904e5a
Instruction Fuzzy Hash: F5515670508A899FEBA4EF28D489B96B7F0FF94314F50066AD44BCB5A5DB39E840CB41

Function 00007DF40154C10C Relevance: 1.6, APIs: 1, Instructions: 121nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154C187

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 5c97c20283281d0f686864c64b2abe35391f7ab31688f0fa8af160c1736108da
Instruction ID: 97003f34cb9a6931a9f7bcbc3f75c6aabcf6edd75c88caa28cef6625be11e283
Opcode Fuzzy Hash: 5c97c20283281d0f686864c64b2abe35391f7ab31688f0fa8af160c1736108da
Instruction Fuzzy Hash: 11310A31B0DA586FFB185E189C8557A73E0EBC9319F20563FE94FD72A5DA28BC024681

Function 00007DF401542258 Relevance: 1.6, APIs: 1, Instructions: 114encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007DF4015422E1

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: a07a12428c7964199d363ccabf4b149c9f1c56c6408fd6f078d364f4c66a6574
Instruction ID: 790687a9a07dd7ae2fe636b8a43343542f616a7f24253120463f9b4447dfb1e9
Opcode Fuzzy Hash: a07a12428c7964199d363ccabf4b149c9f1c56c6408fd6f078d364f4c66a6574
Instruction Fuzzy Hash: 6C31723071CA884FE758DB68D88966FB7F1EBD9341F40452DF48AC7265DA74D8418B42

Function 00007DF40157B104 Relevance: 1.6, APIs: 1, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6300fb348d49a47f7ce5e25661db4a1277b3c7de01d4304b532d2da97ee81cb4
Instruction ID: 089e81f959564cc12d5f5ac6ddcd3f5e8915e2fa420ef684c0dc21139bf0482f
Opcode Fuzzy Hash: 6300fb348d49a47f7ce5e25661db4a1277b3c7de01d4304b532d2da97ee81cb4
Instruction Fuzzy Hash: 6BC1C330608A549FEB58DF18D886BA577E0FB88300F10067AE84FDF25AC734A851CB85

Function 00000251D30915AC Relevance: 1.6, APIs: 1, Instructions: 76
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,00000000,00000251D3091E16), ref: 00000251D3091640

Memory Dump Source

Source File: 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_251d3090000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction ID: c599ee391b192d98ccb1eed31491221507a39036c5f6315ff0305f9558996aef
Opcode Fuzzy Hash: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction Fuzzy Hash: D7216D71A18B088FDB58DF58C8C966AB7F1FBAC306F080A2EE44AC7260D730D485CB41

Function 00007DF40154AC0C Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154AC70

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d99824a7b56689602d55d9b975c23b4966fb1dfc1a28fa016acf5b8b83f0fdf8
Instruction ID: 18e923d41bcea4a5e6df50cdfab8a2f44946f9e1eaff056901926bab6a8824b1
Opcode Fuzzy Hash: d99824a7b56689602d55d9b975c23b4966fb1dfc1a28fa016acf5b8b83f0fdf8
Instruction Fuzzy Hash: B6F0623491C7C59FDBA1EB688480B9ABBF0BBAA354F544A1EE8CDC3211D73595848B43

Function 00007DF40154ADD4 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154AE23

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: af3340e2b301fb20eba4bd36f70d30fdbe005acca17dd1e0c445e9428843075b
Instruction ID: 03469886acb13a008b41bf8176d743327802dfd911cb7d5ee8b9ba0fed2d6457
Opcode Fuzzy Hash: af3340e2b301fb20eba4bd36f70d30fdbe005acca17dd1e0c445e9428843075b
Instruction Fuzzy Hash: C3F0D074A1CB948FDBA4EF2CD4C5B5977E1FB98304F504519E44DC7255EB3498808B46

Function 00007DF40154AF60 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,00000000,?,?,00000000,00007DF40153341C), ref: 00007DF40154AF8A

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1d9a6f3c19fc3a1664a9a6811ff4ba6c27299ee4e4794d390710366357d59dbc
Instruction ID: e684f35452e50d542f73f7b6bb6871da43270947077ff05a816ea7fb26ea410f
Opcode Fuzzy Hash: 1d9a6f3c19fc3a1664a9a6811ff4ba6c27299ee4e4794d390710366357d59dbc
Instruction Fuzzy Hash: DEE09B756186449FDB04DF94C8C186AB3F4FBD9304F004D3AE85BCB174D274D598C682

Function 00007DF40154ACE8 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154AD03

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: a9327488733b823840a3f29582a089392b2a1446868cb63a967a810240f58cb8
Instruction ID: 5311f369492c60de74b09d9abc99b8ea85d703af65b133deff7cd77aeb9615bd
Opcode Fuzzy Hash: a9327488733b823840a3f29582a089392b2a1446868cb63a967a810240f58cb8
Instruction Fuzzy Hash: ACD0A730DACB894BE650B728C80061637F1FBD430CFD44614D88EC7254D23CE4418386

Function 00007DF40154AD14 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154AD2F

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 4927af5c10e17f27f2edd3b7dd4d43612d79bd47543f67f71f12626d98bff908
Instruction ID: c284fc6a4e2fe6c10d744d29454a7d3ea04fd13aafe6d9854fde6bbae0255678
Opcode Fuzzy Hash: 4927af5c10e17f27f2edd3b7dd4d43612d79bd47543f67f71f12626d98bff908
Instruction Fuzzy Hash: 3ED0A730EACBC94BE650B728890020A37E2FBD530CFD04624D88ED3264D23CE4018382

Function 00007DF40154AE5C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154AE77

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: eb8f498348e5c7f372421b27a3827434041340d731fc3728b954386bc4ea4cc4
Instruction ID: b86432dbe3e9846520596e7eb3b4e32468c8861d4a89cd1ffddeadd281edb957
Opcode Fuzzy Hash: eb8f498348e5c7f372421b27a3827434041340d731fc3728b954386bc4ea4cc4
Instruction Fuzzy Hash: 2CD05E24A68A894FE6A0A728894020637E2FBD5308F914618E44EC3214D23CE41142C2

Function 00007DF40154ACC8 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154ACD8

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 333093483b5b65ac6ab85e83ccc52a142bbc301cae1d85d61a22b47e66de8b6c
Instruction ID: cfce525f7365045e5e4de1d4b929964b7b5bef0686181688f85899926cecd239
Opcode Fuzzy Hash: 333093483b5b65ac6ab85e83ccc52a142bbc301cae1d85d61a22b47e66de8b6c
Instruction Fuzzy Hash: 01C08C20AAD84B2BF9D462B98C8164620A0AB8C308F820010F80BD7198E42CE4E09396

Function 00007DF40154AF40 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF40154AF50

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 953671860da08bf31fab518e05a010f803d920f951da2702e38e3d0cf3acdea6
Instruction ID: ed37863eb589a709d67f297bbf14256aa53a149974381fa933357267a296eee6
Opcode Fuzzy Hash: 953671860da08bf31fab518e05a010f803d920f951da2702e38e3d0cf3acdea6
Instruction Fuzzy Hash: BEC08C04AA981BBBF98862AA6CC035920A0AB88308F800011E42FD75D4E42CE4D44392

Function 00007DF4015365E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF401536640
VirtualProtect.KERNELBASE ref: 00007DF401536669
VirtualProtect.KERNELBASE ref: 00007DF401536685
VirtualProtect.KERNELBASE ref: 00007DF4015366B0

Strings

rE\, xrefs: 00007DF4015365FE

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: dc7abe3753608a406b2e8c4677f2e3e348cb1d8b9abc271147da51083885c1c3
Instruction ID: 162c8b267a065f6c898cc127e69cd12ba2e6593dfc7626a012de6b3cd0fe70fc
Opcode Fuzzy Hash: dc7abe3753608a406b2e8c4677f2e3e348cb1d8b9abc271147da51083885c1c3
Instruction Fuzzy Hash: C921AF317089485BEB54E758A891AAB72E6FBD8700F00003AE44BD7299DE2CEE0587C2

Function 00007DF401533178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF4015331FA
VirtualProtect.KERNELBASE ref: 00007DF401533224

Strings

, xrefs: 00007DF4015331DB

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 45ee73fde44b844a7982fd6fa2bb9a274e67d6e904138dbe31d6ae3e461be495
Instruction ID: 2a434c0d31b7979f3e548ef7fd6e534100c68c92857aa19b48335f40a9c73550
Opcode Fuzzy Hash: 45ee73fde44b844a7982fd6fa2bb9a274e67d6e904138dbe31d6ae3e461be495
Instruction Fuzzy Hash: 0D110631A0889A1BF795A718EC646B6B3F1FBC4310F944136E44BD71F5DA1CE852C781

Function 00007DF401573C98 Relevance: 4.6, APIs: 3, Instructions: 117COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007DF401573CC4
CreateIoCompletionPort.KERNELBASE ref: 00007DF401573CFA
SetFileCompletionNotificationModes.KERNEL32 ref: 00007DF401573D40

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: Completion$CreateFileModesNotificationPortioctlsocket
String ID:
API String ID: 1455841399-0
Opcode ID: b0ef64daf23010be4df91d754ff29401ba7eeb6e21b37df906d22bfb74ec9eab
Instruction ID: 7ac1873a8bdd6ed909c5c1cb1cc9b8296d000d41112ee8f41f1e2be8c899f82e
Opcode Fuzzy Hash: b0ef64daf23010be4df91d754ff29401ba7eeb6e21b37df906d22bfb74ec9eab
Instruction Fuzzy Hash: 5731DF3071C5945BFBE49B18F886A3732E5FF94364F50007AD40FEA1AADB29EC415686

Function 00007DF401546654 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 00007DF40154669B
CoUninitialize.COMBASE ref: 00007DF401546703
free.MSVCRT ref: 00007DF401546711

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: InitializeUninitializefree
String ID:
API String ID: 1169324116-0
Opcode ID: 300bfe15e1352cda4c3c9a5eb26de8ea91f06f6889c64728d4398b9a5c111e42
Instruction ID: e12b2e2752712b090372264fb79cd2a01e86855303aedfaa66b563e12047b817
Opcode Fuzzy Hash: 300bfe15e1352cda4c3c9a5eb26de8ea91f06f6889c64728d4398b9a5c111e42
Instruction Fuzzy Hash: 07215031609A099FEF84EF38D849AAA77E0FF94315F00462AE84FD3155DB38E941CB90

Function 00007DF4015372D0 Relevance: 4.5, APIs: 3, Instructions: 746COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF401524BE4: malloc.MSVCRT ref: 00007DF401524C0D

calloc.MSVCRT ref: 00007DF401537551
free.MSVCRT ref: 00007DF4015375BD
free.MSVCRT ref: 00007DF401537AB3

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free$callocmalloc
String ID:
API String ID: 1437353635-0
Opcode ID: 6cebd9367394abf21773eb1584d65681aa51e4210b0eb886ea29ebe4f46530e1
Instruction ID: b9983ea441cb32485ed5d4cfdf9555d89b08f3671ed8df9e0bb4a666ee13329a
Opcode Fuzzy Hash: 6cebd9367394abf21773eb1584d65681aa51e4210b0eb886ea29ebe4f46530e1
Instruction Fuzzy Hash: 01426070918F489FEB95EF28D489AAAB7F1FB98300F10462AD04FD7265DF34A545CB81

Function 00007DF401524BE4 Relevance: 3.9, APIs: 3, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF401524C0D
malloc.MSVCRT ref: 00007DF401524C6C
free.MSVCRT ref: 00007DF401524CD0

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: f833b09acc7dcda6218a08ced81fc052c99920b07a41f041528abf3627ace0e1
Instruction ID: 2eb038c03f9042a54e57b0f776997ed3cb0ad3f41026e246132b0ecd7a5c77bb
Opcode Fuzzy Hash: f833b09acc7dcda6218a08ced81fc052c99920b07a41f041528abf3627ace0e1
Instruction Fuzzy Hash: 85319532608A49ABF758EF58D849866B3F0FF95310B004226D81BDB5A5EF64F855C7C1

Function 00000251D31033B0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 344memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00000251D31036F9

Strings

l, xrefs: 00000251D31033D6

Memory Dump Source

Source File: 00000002.00000003.1863513864.00000251D3100000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_251d3100000_OpenWith.jbxd

Similarity

API ID: FreeHeap
String ID: l
API String ID: 3298025750-2517025534
Opcode ID: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction ID: df9cb17b15b3300f57fcbf8a30ec2a68bba1f0e8d63a08b0f049752a618baeec
Opcode Fuzzy Hash: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction Fuzzy Hash: 6CA13B31728A690BD779AA2C8C897BDB7F1FB85301F10096EE4CBC3183DD34D9568685

Function 00007DF4015395F8 Relevance: 3.4, APIs: 2, Instructions: 397COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF40154AF60: NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,00000000,?,?,00000000,00007DF40153341C), ref: 00007DF40154AF8A

CreateFileMappingW.KERNELBASE ref: 00007DF4015398AE
calloc.MSVCRT ref: 00007DF4015399E8

Part of subcall function 00007DF401539478: CreateFileW.KERNELBASE ref: 00007DF4015394D0

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: CreateFile$AcceptConnectMappingPortcalloc
String ID:
API String ID: 2835849967-0
Opcode ID: d1b445dc56701135788b0dc920e68535db059dd4faca11d9a453a424e093dfee
Instruction ID: 1b043d68e9e2ecba8d03217eeec65d2d4e1cd05701c8bf0d5353303f738c156b
Opcode Fuzzy Hash: d1b445dc56701135788b0dc920e68535db059dd4faca11d9a453a424e093dfee
Instruction Fuzzy Hash: 2ED17F7191CB888BE765EF28D4856ABB7E1FB94300F00462EE48FD71A5DF74A5058B82

Function 00007DF40154DDA4 Relevance: 3.2, APIs: 2, Instructions: 238fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007DF40154DADC: malloc.MSVCRT ref: 00007DF40154DAE6

CreateFileW.KERNELBASE ref: 00007DF40154DEBA
ReadFile.KERNELBASE ref: 00007DF40154DFA2

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: File$CreateReadmalloc
String ID:
API String ID: 3950102678-0
Opcode ID: b879bc7b5dc6143657be184a8553957d82cf9a437ba6bdf4bbb2c4680e42a6eb
Instruction ID: 759cc2956ae005c75d9504c9b243d9341c1d5d453ef02033bed440be22faa174
Opcode Fuzzy Hash: b879bc7b5dc6143657be184a8553957d82cf9a437ba6bdf4bbb2c4680e42a6eb
Instruction Fuzzy Hash: 8F71C530A0CB945FE7689F5898C576AB3F1FBD8304F50053FE49FD72A6DA38A8458642

Function 00007DF401539478 Relevance: 3.2, APIs: 2, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007DF4015394D0
ReadFile.KERNELBASE ref: 00007DF401539585

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: File$CreateRead
String ID:
API String ID: 3388366904-0
Opcode ID: 73db5555d885fd7ea61d85234132b183eb459049274d5711c35081ec0b7aef7a
Instruction ID: 7836d30be9cf56ac5cf63bcdf9065a50f591ae22c2face25b4a5d0aeb8b2b5b0
Opcode Fuzzy Hash: 73db5555d885fd7ea61d85234132b183eb459049274d5711c35081ec0b7aef7a
Instruction Fuzzy Hash: 7C41F07070C6884FEB58EF28988566A73E5FFD8705F10452EE88FD7294EE74D8418782

Function 00007DF40154D974 Relevance: 3.1, APIs: 2, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007DF40154D9AB
ReadFile.KERNELBASE ref: 00007DF40154D9E1

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: File$CreateRead
String ID:
API String ID: 3388366904-0
Opcode ID: 6dcf9cfff2eacf5cd94369649f002897bcffdea66228e64647734ab7a70026dd
Instruction ID: 03b74b06ad2f363a7de09389afba93c4bdc52567dbe3fa2307f1d10973bf1001
Opcode Fuzzy Hash: 6dcf9cfff2eacf5cd94369649f002897bcffdea66228e64647734ab7a70026dd
Instruction Fuzzy Hash: 0A21067070C7585FF3689E99A88627B73E4EBD9714F10013FE88FC2256DA74A8064686

Function 00007DF401522980 Relevance: 3.1, APIs: 2, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF4015229BF
VirtualProtect.KERNELBASE ref: 00007DF401522A25

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e54d32ce24f4b710544f648fa16c64d8d7f0589b34fc61474f65512f49413183
Instruction ID: 5f90fd794049417b449e08db2d9df848aebfe5cb466e8f98014a6959430cd6ca
Opcode Fuzzy Hash: e54d32ce24f4b710544f648fa16c64d8d7f0589b34fc61474f65512f49413183
Instruction Fuzzy Hash: DE310B3170C6854BE7149F6CD8947663BD1FF9A310F1503A5E88EDB2D9CB98D842C341

Function 00007DF401524774 Relevance: 2.7, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF40152494C
free.MSVCRT ref: 00007DF4015249F3

Part of subcall function 00007DF401524620: malloc.MSVCRT ref: 00007DF4015246EF

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 352f2f2cecbb3e27f866ef48949e4e4dcfd5ee98b9eced5f0af6e5ea8a5601e0
Instruction ID: 341b471f4e95ad0fe9a015a6af3d3db7a82b569bfb5900130119e87cd145c96d
Opcode Fuzzy Hash: 352f2f2cecbb3e27f866ef48949e4e4dcfd5ee98b9eced5f0af6e5ea8a5601e0
Instruction Fuzzy Hash: A671C431A1C9885AF329A72898956EFB3E1FBD5340F00466FE08FC7197DD38A94586C6

Function 00007DF40153CC5C Relevance: 2.6, APIs: 2, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF40154ACC8: NtAcceptConnectPort.NTDLL ref: 00007DF40154ACD8

malloc.MSVCRT ref: 00007DF40153CD0D
free.MSVCRT ref: 00007DF40153CD94

Part of subcall function 00007DF401543848: malloc.MSVCRT(?,?,?,?,?,FFFFFFFF,-00000001,-00000002,-00000001,00007DF401562CFA), ref: 00007DF401543867

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc$AcceptConnectPortfree
String ID:
API String ID: 342249184-0
Opcode ID: 694a03a6a0a341675988201f7685504af8169e7f1b53cb1e5f9007a100a90dea
Instruction ID: f0e717beca0b23e38bb915654220535f3730869e3cf5d152a848ba0174c67b81
Opcode Fuzzy Hash: 694a03a6a0a341675988201f7685504af8169e7f1b53cb1e5f9007a100a90dea
Instruction Fuzzy Hash: ED415371508B4C8FEB54EF18D8856A677E1FF94311F00056BE84ECB265DB34E985CB81

Function 00007DF40153CA08 Relevance: 2.6, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,?,?,?,?,?,?,?,-00000001,00007DF40153D046), ref: 00007DF40153CA30

Part of subcall function 00007DF40154BCC0: NtAcceptConnectPort.NTDLL ref: 00007DF40154BD8F

free.MSVCRT ref: 00007DF40153CA66

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPortcallocfree
String ID:
API String ID: 1866692179-0
Opcode ID: 1c81860f17a6367f43a2a94f10a5d32e0a9fa92ddff0a1d18b0803ced88c0a31
Instruction ID: e63c0a96736d8f6ab59355ccefe7c1aacdb55b7d38138b66482183d31fef98b1
Opcode Fuzzy Hash: 1c81860f17a6367f43a2a94f10a5d32e0a9fa92ddff0a1d18b0803ced88c0a31
Instruction Fuzzy Hash: 87F02831214D0C4FE748AB2C9C886B637E1EB94726754462BE00BD7264DD78DD418780

Function 00007DF401546720 Relevance: 2.2, APIs: 1, Instructions: 947COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF401546956

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 4c67779dd63165b43659fab8fd510d9b574d13d676e16a29e3859926c8de3004
Instruction ID: 9beb2ebc0684322c49f3edc6b57fe902507db119cbcb268eed3b72e538a8f888
Opcode Fuzzy Hash: 4c67779dd63165b43659fab8fd510d9b574d13d676e16a29e3859926c8de3004
Instruction Fuzzy Hash: 1772843051CA889BE769EB18D485ADEB3E1FFD5300F50462EE48F971AADE34E4458782

Function 00007DF40153913C Relevance: 1.8, APIs: 1, Instructions: 316COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE ref: 00007DF401539372

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 090a60165b6d81dbbef6ccd1718067ffa9bcceaffdfa6db13320491a5d5642c1
Instruction ID: 847e9b246410df0cc92975be91e5e43a7b1acd6842d05c8d8c3eab2fcfdeb26c
Opcode Fuzzy Hash: 090a60165b6d81dbbef6ccd1718067ffa9bcceaffdfa6db13320491a5d5642c1
Instruction Fuzzy Hash: 10A16F7160CA889FEB54EF18C4859ABB3F1FBA4300F404A2EE44FD71A5DE74A945CB81

Function 00007DF401574D8C Relevance: 1.8, APIs: 1, Instructions: 281networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF401574EF2

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 653fe3a6da9e8edf6d7f9aad963387fd79a7ca64ce6bed9a03fbf4fad2203229
Instruction ID: 7707fd494910fd40671a5e831cbbe1ff0cca94ea2b98749002c7276df2942604
Opcode Fuzzy Hash: 653fe3a6da9e8edf6d7f9aad963387fd79a7ca64ce6bed9a03fbf4fad2203229
Instruction Fuzzy Hash: 0FA12630A28A856FF794CF18A48ABA6B3F0FF95314F40052AD45FDA5E4E738F8518785

Function 00007DF401545004 Relevance: 1.7, APIs: 1, Instructions: 245registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007DF401545225

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e8d5d7329d2320a05d82013e26ca3d8c66ee9948d03da3e8e50157f1609a8dd5
Instruction ID: 55aab0f2937fa5bf3613ab2b96acfbc7ca635343d591e47527c589d39aa1b3bb
Opcode Fuzzy Hash: e8d5d7329d2320a05d82013e26ca3d8c66ee9948d03da3e8e50157f1609a8dd5
Instruction Fuzzy Hash: 1291BB3161DB889FE765EF24C489B9BB7E1FB98305F00492BE48AC7264DB34D544CB42

Function 00007DF401574B28 Relevance: 1.7, APIs: 1, Instructions: 227networkCOMMON

Download Yara Rule

APIs

WSASend.WS2_32 ref: 00007DF401574BDF

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: d8e018eafecf73722f3cfd2108c578dd3fd3213e6426fbbfe5b50f999653df9c
Instruction ID: fc4dd19b30bc5c6fdbb02e7b81ab24af021aae55a67f0bb53856e6348d7b3a1b
Opcode Fuzzy Hash: d8e018eafecf73722f3cfd2108c578dd3fd3213e6426fbbfe5b50f999653df9c
Instruction Fuzzy Hash: 6F819070608A499FEB98DF28D485BA6B7F4FF94314F00426AD44ECB6A5DB35E840CB85

Function 00007DF401535960 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 00007DF401535B1D

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 458a1419ed12d8a3c2e86420f2914f8409b820493848f008ec8053e1bf8f0b77
Instruction ID: fd7b727252157bd5d4bcda6d39a2fcc12d154940227c4a5dc253c27337c63941
Opcode Fuzzy Hash: 458a1419ed12d8a3c2e86420f2914f8409b820493848f008ec8053e1bf8f0b77
Instruction Fuzzy Hash: 72618C3151CB889BE765EF64D885AEBB7E1FBD8300F400A2EE08BD7164DE34A505CB42

Function 00007DF40154D6FC Relevance: 1.7, APIs: 1, Instructions: 176processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 00007DF40154D7F5

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e9169745a3f5c8f3addee9eb58fc29d082d9d243fdbbd28d7b824531286ef21a
Instruction ID: 8ee396f65bd164369c25a8ebc25f72b4982e84ba2d945f7da15fcb0c43ddf437
Opcode Fuzzy Hash: e9169745a3f5c8f3addee9eb58fc29d082d9d243fdbbd28d7b824531286ef21a
Instruction Fuzzy Hash: 15512D3161C7985BF764DBA8D84976BB7F5FFE4314F00092EE48AD31A5DA78E8018B42

Function 00007DF401548F84 Relevance: 1.7, APIs: 1, Instructions: 414COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF4015493FA

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2b200ceb4e4cc9f035faf7b6c1b247c7413155f6bad845cc72cf0ce4a6dd00dc
Instruction ID: 0f52ac5390eb08cfd2c7e15416145f72ed4f67d40234183f884e9ea6e550fcad
Opcode Fuzzy Hash: 2b200ceb4e4cc9f035faf7b6c1b247c7413155f6bad845cc72cf0ce4a6dd00dc
Instruction Fuzzy Hash: 30D1803161CA885BFB65EB14D4966EF73E1FFD8344F00052FD44FDB1AADA38A9058682

Function 00007DF401537B7C Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF4015365E0: VirtualProtect.KERNELBASE ref: 00007DF401536640
Part of subcall function 00007DF4015365E0: VirtualProtect.KERNELBASE ref: 00007DF401536669
Part of subcall function 00007DF4015365E0: VirtualProtect.KERNELBASE ref: 00007DF401536685
Part of subcall function 00007DF4015365E0: VirtualProtect.KERNELBASE ref: 00007DF4015366B0

TlsFree.KERNELBASE(?,?,?,?,?,?,?,00000000,?,?,00000000,00007DF40153341C), ref: 00007DF401537CB7

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual$Free
String ID:
API String ID: 3841229516-0
Opcode ID: 9454607179550a56fcb25c77309fc397396c8818e949c4bf6b88fbdfb1fa50f0
Instruction ID: d94a8b062b68b99dc402f485a27fcf00b1d9df0bc0ef0371037af0cbd2cc300f
Opcode Fuzzy Hash: 9454607179550a56fcb25c77309fc397396c8818e949c4bf6b88fbdfb1fa50f0
Instruction Fuzzy Hash: 2A41C531B08A4C5BFB54EB68D4C456E73A1EF89700B404577E41BEB2AADA28FC408781

Function 00007DF401533320 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF401523DD8: RtlAddFunctionTable.KERNEL32 ref: 00007DF401523E05

SetErrorMode.KERNELBASE ref: 00007DF401533408

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: ErrorFunctionModeTable
String ID:
API String ID: 928017140-0
Opcode ID: d9c23544fbb2a9f569b4c70e99ee3ada11af114710c16124923c5dd5b1b488fd
Instruction ID: f2b3d250b4469e43b61ead80ed775a37a094bf7934891ef96a806711c8e2d77c
Opcode Fuzzy Hash: d9c23544fbb2a9f569b4c70e99ee3ada11af114710c16124923c5dd5b1b488fd
Instruction Fuzzy Hash: F7318731B1C9896BFB94FB58988656A72E1FFC8310B90053AE00FDB2FAD91CED458241

Function 00007DF4015752D0 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF401575344

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 5ecb9aca37cfa74a852660f22e24977ddf5ffe3d9d8c212dab6545ea967c75f3
Instruction ID: a45e605a45448dc82ba5a27ac80639c798f7b9e1102a9fcfc6685c6f33524d7e
Opcode Fuzzy Hash: 5ecb9aca37cfa74a852660f22e24977ddf5ffe3d9d8c212dab6545ea967c75f3
Instruction Fuzzy Hash: EA31E970914A459FFB98DF189089B6177E1FF54325F1002AAD81EDF2EAE7749881CB44

Function 00000251D309185C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessMitigationPolicy.KERNELBASE ref: 00000251D309192F

Memory Dump Source

Source File: 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_251d3090000_OpenWith.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction ID: 11ef596a1a665abd8028dffcb3db9760aa752d51670ca8861f93d7ddaa853044
Opcode Fuzzy Hash: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction Fuzzy Hash: C831A530321E264AEF6997688C887F173E9EB983A2F1C41B98057C61E1DA71D862C764

Function 00007DF40153B764 Relevance: 1.6, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF40153BAA3

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c8a5416c91b5153a76d254bfa4ef07326f1cac8c2947bbd921b64d27c5c1bc1f
Instruction ID: 6552e95cd09ba76dc5bd261ab623366e6b1090e2e6623d8c1c83f697a0f85f69
Opcode Fuzzy Hash: c8a5416c91b5153a76d254bfa4ef07326f1cac8c2947bbd921b64d27c5c1bc1f
Instruction Fuzzy Hash: FDB1E231A18948AFEB99EF28C4D1A9773F1FFD8300B504566D40EDB2AADE24F951C781

Function 00007DF401522910 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00007DF401522948

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a1e79bfd5fdfa4d599be838d72d64bf9e685b5698f2b0b05ab8498b458f49234
Instruction ID: 2876b04d32d0306e7d8243875cb9cb396ff83a8b7264400e0b4e7116a1cee644
Opcode Fuzzy Hash: a1e79bfd5fdfa4d599be838d72d64bf9e685b5698f2b0b05ab8498b458f49234
Instruction Fuzzy Hash: CA01A732B149199FFB54AB69DC8467633E5EF89391B044075E80ED6168DB39A882C780

Function 00007DF401522BB0 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 00007DF401522BF6

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: e8b38785987ebe4bf97a71b2e294a612045f12fa57e0274daf3e7e500e703184
Instruction ID: 5aff77f1020c02d2b0afad43d99a9976d0d9ccd1790f8a72ff8d7b663bd05e7a
Opcode Fuzzy Hash: e8b38785987ebe4bf97a71b2e294a612045f12fa57e0274daf3e7e500e703184
Instruction Fuzzy Hash: 77018C75A086559FEB50EF6AFC8612636B0FB98311B40413FE00EDB9B4CA385880CB40

Function 00007DF401522B5C Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00007DF401522B7C

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: f6a5c260a6ff26826b95901847e0f94daf167b208f970919ab6999429e88efbf
Instruction ID: 2b2cc18365b392ac32337c8c11dab092908fad57d64fe9c20944e378a1882369
Opcode Fuzzy Hash: f6a5c260a6ff26826b95901847e0f94daf167b208f970919ab6999429e88efbf
Instruction Fuzzy Hash: 88F0A076B182855BF720AF766C8112A61B29BC8312F54453BE80BCE1A9DC3998818A40

Function 00007DF401533088 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00007DF4015330AF

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: c2543c20c0a7d110227d86949c13dfaa5e54e54e664fb098b1aa0bdcf88303a9
Instruction ID: 34020377ed4b81a63140576b94f3d15effff1d1435ee34afae7ec8aa7fb35c9b
Opcode Fuzzy Hash: c2543c20c0a7d110227d86949c13dfaa5e54e54e664fb098b1aa0bdcf88303a9
Instruction Fuzzy Hash: 6EE0C211B18C091B7BA862AE248CA7755D6DBDC232344027BE41ED72A9EC58CC850380

Function 00007DF401545644 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF40154568F

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: ddedd6023ad442b8d2b2fe3290ed3783bcd232237776f9c3a295af58d00cf6c3
Instruction ID: 8805acb2501d3561ec01f357c6e90076106209fc470426c068472666aa07ddb7
Opcode Fuzzy Hash: ddedd6023ad442b8d2b2fe3290ed3783bcd232237776f9c3a295af58d00cf6c3
Instruction Fuzzy Hash: F3F08C74214A044FEB48EF5CC48876677E2FFE8329F10016AE90ECB2E4DB369989C741

Function 00007DF40154D8E4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007DF40154D909

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 23f3765db31a0df280e37a6bc4f8137308a1fee0486dc2818908f898aea27d2f
Instruction ID: c076b59af0e72806b2472201f695b54bc63e28b6ed3703abb36710452691a838
Opcode Fuzzy Hash: 23f3765db31a0df280e37a6bc4f8137308a1fee0486dc2818908f898aea27d2f
Instruction Fuzzy Hash: ADE0C232B150240BF72C6ABD2C8917A36DAC7CC572705423BF80AC3284ED7C8C4602D1

Function 00007DF401523DD8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF401523E05

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: 3b09555bf32cd7a482aca5e21dc4f37ab037edd0c1b9afc7390cc3b8e22e33b4
Instruction ID: 6b1552c0e1582113b1acf60802a7708e8712517815cffed202f1a53ffebe48a9
Opcode Fuzzy Hash: 3b09555bf32cd7a482aca5e21dc4f37ab037edd0c1b9afc7390cc3b8e22e33b4
Instruction Fuzzy Hash: BCE086305509055FEFA8E61DC8493503AE0FB9C306F6442ADD405D92A5DB3DD89BCF81

Function 00007DF40153305C Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00007DF40153307E

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: 572788d3507ee2099820c6a2dae4c638e99f6bf386f4c784f5d9b32c5561147d
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 70D0A721724D0D2BFB88633D1C9472651D5FBCC221F94017BF40EC6285ED5CCC550351

Function 00007DF4015A9F04 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,00007DF4015BB7C7,?,?,?,?,00000000,00000000), ref: 00007DF4015A9F21

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d72fac8d1d1b7f96bb5fe0759d88f2d5c6e0343dfc4f10e03c2c9322f33a3d86
Instruction ID: e9769df5e2b9b6e4ab05540a8ce222c814d0ceda1ea8d221698a4440a5e35679
Opcode Fuzzy Hash: d72fac8d1d1b7f96bb5fe0759d88f2d5c6e0343dfc4f10e03c2c9322f33a3d86
Instruction Fuzzy Hash: D2E04F319198594BF30DF731DC958E73271EBA4300F914637D807A60B6ED2C66498681

Function 00007DF401535CC3 Relevance: 1.4, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF401535D10

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 903acddc3c2cbd21899d181af60d2020bd4c0d22b9f6ec9809e98e44769c02c6
Instruction ID: 09491a9d9ddbe18b1f7a444a6a067e9141ac7ecde038e25c4694517a20fb6106
Opcode Fuzzy Hash: 903acddc3c2cbd21899d181af60d2020bd4c0d22b9f6ec9809e98e44769c02c6
Instruction Fuzzy Hash: A2413130618D489FEB94EB18C485E96B3F1FFE4310F50466AD44EDB1AADA34F941CB81

Function 00007DF4015435F4 Relevance: 1.4, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF4015436C2

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 31b51a1252b2397096177e19cb7010b666d546ef653b70412147a1dab026b8b6
Instruction ID: 7571c8d002ed0ec3cdfd12c6279cb1ebc31dac2308db8690fbe02b16ec58fd56
Opcode Fuzzy Hash: 31b51a1252b2397096177e19cb7010b666d546ef653b70412147a1dab026b8b6
Instruction Fuzzy Hash: 3341A030608D1E9FEB98EF6CD888A6577F1FBA8311710422BD41AC7664DB74E8948BC0

Function 00007DF401524620 Relevance: 1.4, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF4015246EF

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: c3b5330ba83a094f7bad87bbcfda8b7898b28b22e9f53235a9dbd9f71cfcc7c9
Instruction ID: 4ef613a779e9d45628a74a38a18613d9d8df259052bb05d528efbc5bdbb4c451
Opcode Fuzzy Hash: c3b5330ba83a094f7bad87bbcfda8b7898b28b22e9f53235a9dbd9f71cfcc7c9
Instruction Fuzzy Hash: 7941E631A084985BFB68DF2888D407B37E1EFC6305714817BD86BCE19ADA28E947C7D0

Function 00007DF4015FB260 Relevance: 1.4, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,?,?,?,?,?,?,00007DF401545770), ref: 00007DF4015FB282

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 1510f62e4c51649cb4b3fc6bb3479c9fee78b3cdc066acf53db6694c8fe85d1c
Instruction ID: 2c88d3e0649ab1557008972ecb894192d152f0ecbfd85f80fc47342d78189795
Opcode Fuzzy Hash: 1510f62e4c51649cb4b3fc6bb3479c9fee78b3cdc066acf53db6694c8fe85d1c
Instruction Fuzzy Hash: AD41B570908A188EEBA1DF18D4887D576E5FB68701F2842BBDC4DCF25ADB7498858B90

Function 00007DF401543848 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,?,?,?,FFFFFFFF,-00000001,-00000002,-00000001,00007DF401562CFA), ref: 00007DF401543867

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: aa4f1f029a65678ad9f3ad1f83a567308f2cd0838b93955c777e9bc3ae762b5b
Instruction ID: d541dafc69fcfd0eca9420b2eee1a31d8f21adb7c20c0304805ff19d14ad5845
Opcode Fuzzy Hash: aa4f1f029a65678ad9f3ad1f83a567308f2cd0838b93955c777e9bc3ae762b5b
Instruction Fuzzy Hash: E721A531614D2C8FEB59EF1CD88C76177E1FBA831171441ABD80ADB269DA35E884C791

Function 00007DF4015F9618 Relevance: 1.3, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,-00000002,00007DF4015459FD,?,?,?,?,?,?,-00000002,00007DF401545A9F), ref: 00007DF4015F9669

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c3f3896645624ed2edffa25d0ed107847367446d48ff0b9b56c9f709a2f52a8
Instruction ID: de531c584faa8aa439a1ddb28f30d81ab56ffcb085523361206c55db89aaa71b
Opcode Fuzzy Hash: 3c3f3896645624ed2edffa25d0ed107847367446d48ff0b9b56c9f709a2f52a8
Instruction Fuzzy Hash: A131C034619D499FFF98EF68C4A97A533A1FFD4305F5400BDA80FDE1AACA28A845D710

Function 00007DF40161ABFC Relevance: 1.3, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF40161AC91

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction ID: 00761ca26f2f7110a90d9a2349ef70fafc3013690134544b0da258026491c20c
Opcode Fuzzy Hash: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction Fuzzy Hash: A2216530A098985FDF94EB5CC4C4D6677E2EFD835076906A1E81ED729DD625EC80C780

Function 00007DF401532E18 Relevance: 1.3, APIs: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 00007DF401532E40

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: dd3043cd4fdbf6ce1bec2523c8a3e90b76413ae5d3024df9cc9149889a1f6f13
Instruction ID: da1eab8a9f2825727562937383f5627280ddd6ba365ea628200383059c979ac3
Opcode Fuzzy Hash: dd3043cd4fdbf6ce1bec2523c8a3e90b76413ae5d3024df9cc9149889a1f6f13
Instruction Fuzzy Hash: 6C11DA31F049482FF7999B38984A2B736E1FFD4201F840236D80BDB1B9EE2C9A448240

Function 00007DF401605F24 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,?,?,?,?,00000001,?,00007DF4016062A0,?,?,?,?,?,00000000,?,?), ref: 00007DF401605F50

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: b06512987aa8d2c8df61d034f6c9c76fa6a4a0890f349fee8146c1fc6763cbd3
Instruction ID: f13ca5be398bb8ea5bfe4ca833587b1a2a0ab04719c171610fe6696fbe319efd
Opcode Fuzzy Hash: b06512987aa8d2c8df61d034f6c9c76fa6a4a0890f349fee8146c1fc6763cbd3
Instruction Fuzzy Hash: 99015630614D495FFB94EF6C8888A2772A1FBD831175486BAE81EC729DDA38DC51CB90

Function 00007DF40153BAB4 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,-00000001,00007DF40153D0B5), ref: 00007DF40153BAFB

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 75680fa04e19e4440b4640af9aa4d4391f4b0436c9268b337d289e293cb6ea92
Instruction ID: eac061c45812d33c2a92540edc946fb4c869999ddabf1178bb599e4743dd16b5
Opcode Fuzzy Hash: 75680fa04e19e4440b4640af9aa4d4391f4b0436c9268b337d289e293cb6ea92
Instruction Fuzzy Hash: 2C01F63020894C9FEF98EB1CD4D8E5573E5EBA8310B5805AAD40EDF259CA65EC828B40

Function 00007DF401526540 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,?,?,-00000001,?,-00000001,00007DF4015265CE), ref: 00007DF401526585

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction ID: 7fa4cc82fda70c8eec4ca4838c37ea42e038ff723c864d7253e7f31778fccad2
Opcode Fuzzy Hash: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction Fuzzy Hash: 5901D631B05E066BF3689B29D488322B3E1FB98311F04413AE809C7298DB38E890C7C0

Function 00007DF4015224F4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007DF40152254E

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 85f62002f11eda201487085593c698b0135f5f3e41b5990a1ae8dfcda2a01f33
Instruction ID: e9cc0313023d838b451da1cac3f3856beee3c2b1526b8f43eb9a8f0043224822
Opcode Fuzzy Hash: 85f62002f11eda201487085593c698b0135f5f3e41b5990a1ae8dfcda2a01f33
Instruction Fuzzy Hash: A2016235B18E495BFB58DF2C986422132E1FB99315B54C16ED00FDE2F8EA29E8428701

Function 00007DF4015802AC Relevance: 1.3, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,00000000,00000000), ref: 00007DF4015802F2

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e005b8aad8ae59e5c4306d33e7cf4f806ca0153c9240256dc9db618efce1777c
Instruction ID: 060b7151fe355e7dd0aaf48dd159bb1b432291f7446086c802a637b2481f294d
Opcode Fuzzy Hash: e005b8aad8ae59e5c4306d33e7cf4f806ca0153c9240256dc9db618efce1777c
Instruction Fuzzy Hash: E1F04F3061BA0E9BFF5CBB65985862B37B0EB54302B04103FEC0BE11A4CA6D98549721

Function 00000251D30919A0 Relevance: 1.3, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00000251D30919E5

Memory Dump Source

Source File: 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_251d3090000_OpenWith.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction ID: 1f2e29078b03b8326d867a8921467dd4739d760f7a59c5557b28417a707368ee
Opcode Fuzzy Hash: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction Fuzzy Hash: 18F03A31215A098FDF9CEF95C8D9FA133A4EB28301F0801B9CC0BCB15ADA21E885C791

Function 00007DF40154DADC Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF40154DAE6

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4c39f900df3972edeb9c523e4745635d2babc99cae264e1317ea5b764d4d565e
Instruction ID: 3139d04137c5fdddccc4a9c243cca7526c7bbb4ae047b03b3569a3312356b63a
Opcode Fuzzy Hash: 4c39f900df3972edeb9c523e4745635d2babc99cae264e1317ea5b764d4d565e
Instruction Fuzzy Hash: 9ED05E10B16D0D1BBB58A6BE1C8A12621E6D7E81627440537B80AC3264ED29CC458250

Function 00007DF40154379C Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF4015437C5

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 38b5563491cec97da23afbec1dbe8fd433f77e7ca0be4d4ad2848afd0e677fff
Instruction ID: 5b5ae461d440e7ec0cdcc6d7c2db212cd88ecb84c6fca26ca08655d7e2e0be88
Opcode Fuzzy Hash: 38b5563491cec97da23afbec1dbe8fd433f77e7ca0be4d4ad2848afd0e677fff
Instruction Fuzzy Hash: DAE08C3052592D8FEF88EB388948B5232F0FB48308F840865D00AC61F4D73CD680C701

Function 00007DF40152FBE8 Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF40152FBEE

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 7aac0fcb7c972547ff5d390886f6270a0f974cec2218a33fb889b5e6a18d3d37
Instruction ID: d7ef21bb14e60270f143156929b1f422bfba92532e21d7599281b3dacff181cf
Opcode Fuzzy Hash: 7aac0fcb7c972547ff5d390886f6270a0f974cec2218a33fb889b5e6a18d3d37
Instruction Fuzzy Hash: F0D01270A0A80A0BBB9076FB6CCE13929A8DB282027000026E819C1274EA08C8A4E792

Function 00007DF401524A20 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF401524A29

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 551c0ffc82b28a3876ee79cfc9de3840c8837f1e4274ad0e5daf9a8a7b3ff23c
Instruction ID: d4e9eccf8bb7e9b972e70a6a4b3c534b8f70f526710aa96edd88da372236da3b
Opcode Fuzzy Hash: 551c0ffc82b28a3876ee79cfc9de3840c8837f1e4274ad0e5daf9a8a7b3ff23c
Instruction Fuzzy Hash: A9B01234D27C4F13FD4C33770E590293661AF58202FC40015E807C4868E78CC4D4A346

Function 00007DF40154DD18 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,?,00007DF40153BA73), ref: 00007DF40154DD21

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: aa089de65a6cfd9dc02d261aa503efaa6fd5d5a1e0a60673f9a4ee977fe4c43d
Instruction ID: 5a8c08ec907c1bf7cf0c87233b30f88344d6f78b5bcdb95f0d26b10f359ed4a8
Opcode Fuzzy Hash: aa089de65a6cfd9dc02d261aa503efaa6fd5d5a1e0a60673f9a4ee977fe4c43d
Instruction Fuzzy Hash: 06B01224C2BC6F63FF5D33B64C590153570AF54205FC40015DC06C0458ED2EC0944352

Function 00007DF401535BBC Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF401535BC5

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b7031c71d370f0c4b9d1add862bc0dfec61c612abdfff09cb5e9d61695c69b58
Instruction ID: f83ba9bf4f48c281877cbb087044135235d795d4e9134deb21405a6a78b3625c
Opcode Fuzzy Hash: b7031c71d370f0c4b9d1add862bc0dfec61c612abdfff09cb5e9d61695c69b58
Instruction Fuzzy Hash: BCB012348EBD4B52FD0C33760DE91593960BF54201FC50025D807D4064F50EC09A47D6

Non-executed Functions

Function 00007DF40154E261 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2117128759.00007DF401521000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF401521000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df401521000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f5df41ea43a57528ce76f95f617c5d60ae02f95908509022172248d9e28bd8
Instruction ID: 317b8491c6c81d94af8fc2b3a06f72133790875556e8c436f9feff669d1d81d5
Opcode Fuzzy Hash: 46f5df41ea43a57528ce76f95f617c5d60ae02f95908509022172248d9e28bd8
Instruction Fuzzy Hash: FFB01130E28808C2C2280E0AF802330F2B0C30B300F00303A2000F3A20C8BACC82008F

Function 00000251D3090511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2117417948.00000251D3090000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000251D3090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_251d3090000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction ID: 9c6f723353de5f7bfac1b68b00d860ec9f8fa9508ac40f659eae0282c9a534f1
Opcode Fuzzy Hash: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction Fuzzy Hash: 26B01132E28A0082E3880E0AB8023B0F2B0C30B300F00B0322008F3220C828CC08028F

Analysis Process: wmlaunch.exePID: 7720, Parent PID: 7404COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	14.9%
Signature Coverage:	0%
Total number of Nodes:	289
Total number of Limit Nodes:	23

Executed Functions

Function 00007DF4E2E91958 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337nativememoryCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF4E2E9199B
NtAllocateVirtualMemory.NTDLL ref: 00007DF4E2E91A3A
NtWriteVirtualMemory.NTDLL ref: 00007DF4E2E91A88
NtQueryInformationProcess.NTDLL ref: 00007DF4E2E91AB0
NtReadVirtualMemory.NTDLL ref: 00007DF4E2E91AE0
NtReadVirtualMemory.NTDLL ref: 00007DF4E2E91B13
NtReadVirtualMemory.NTDLL ref: 00007DF4E2E91B42
NtReadVirtualMemory.NTDLL ref: 00007DF4E2E91B76
NtProtectVirtualMemory.NTDLL ref: 00007DF4E2E91BBD
NtProtectVirtualMemory.NTDLL ref: 00007DF4E2E91C44
NtWriteVirtualMemory.NTDLL ref: 00007DF4E2E91C69
NtProtectVirtualMemory.NTDLL ref: 00007DF4E2E91C8D

Strings

H, xrefs: 00007DF4E2E91C15
H, xrefs: 00007DF4E2E91BF2

Memory Dump Source

Source File: 00000006.00000003.2059711361.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: MemoryVirtual$Read$Protect$Write$AllocateInformationProcessQuerycalloc
String ID: H$H
API String ID: 874015164-136785262
Opcode ID: 8b723a4ddad616be20f9dda8abf44bc9042e1d61a48c0cd72079f3722cd3507a
Instruction ID: 9b3c1338cb038a02843ba0beb795d6fe5c4a2c7229105adc8981a04c0b6c3e52
Opcode Fuzzy Hash: 8b723a4ddad616be20f9dda8abf44bc9042e1d61a48c0cd72079f3722cd3507a
Instruction Fuzzy Hash: DFB1407060CB988FDB64DF18D885B9AB7E5FBD5300F040A6EE5CAC3251DA34E5458B86

Function 000001E4D5872D24 Relevance: 15.3, APIs: 1, Strings: 7, Instructions: 1263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001E4D5864998: calloc.MSVCRT ref: 000001E4D58649CB

RtlFormatCurrentUserKeyPath.NTDLL ref: 000001E4D587386B

Strings

N, xrefs: 000001E4D5873A58
;$dW, xrefs: 000001E4D5873D1C
MZ, xrefs: 000001E4D5873583
t, xrefs: 000001E4D5873A60
;$dW, xrefs: 000001E4D587352D
MZ, xrefs: 000001E4D5873971
;Ln, xrefs: 000001E4D58731B4

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: CurrentFormatPathUsercalloc
String ID: ;$dW$;$dW$MZ$MZ$N$t$;Ln
API String ID: 4207655178-84560671
Opcode ID: 1512b8534d4c685afcc9061355cc33150ae67fa718ee72ec55426bd84ba67b64
Instruction ID: 4e77b9fd00175aed4efe55a17e0470adc8d1454822a76c181332fe380acd5e79
Opcode Fuzzy Hash: 1512b8534d4c685afcc9061355cc33150ae67fa718ee72ec55426bd84ba67b64
Instruction Fuzzy Hash: 59A27CB0918B888FD375DF18D8857EAB7E4FBA9701F500A2ED88AC3251DF7495518B83

Function 00007DF4E2E91CE8 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 296processnativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007DF4E2E91290: RtlAddFunctionTable.KERNEL32 ref: 00007DF4E2E912BD

Part of subcall function 00007DF4E2E912C8: VirtualProtect.KERNELBASE ref: 00007DF4E2E912F5

Part of subcall function 00007DF4E2E91438: RegOpenKeyExW.KERNELBASE ref: 00007DF4E2E91497
Part of subcall function 00007DF4E2E91438: RegQueryValueExW.KERNELBASE ref: 00007DF4E2E914E6
Part of subcall function 00007DF4E2E91438: RegCloseKey.KERNELBASE ref: 00007DF4E2E9150C
Part of subcall function 00007DF4E2E91438: GetVolumeInformationW.KERNELBASE ref: 00007DF4E2E91570

calloc.MSVCRT ref: 00007DF4E2E91DE3
CreateProcessW.KERNELBASE ref: 00007DF4E2E91F80
NtResumeThread.NTDLL ref: 00007DF4E2E91FA5
CloseHandle.KERNELBASE ref: 00007DF4E2E91FBF
free.MSVCRT ref: 00007DF4E2E91FDC

Strings

-, xrefs: 00007DF4E2E91E95

Memory Dump Source

Source File: 00000006.00000003.2059711361.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: Close$CreateFunctionHandleInformationOpenProcessProtectQueryResumeTableThreadValueVirtualVolumecallocfree
String ID: -
API String ID: 167522227-2547889144
Opcode ID: 105c85825427e7c8ed203293b96c467a96f9bba36c05be2648f83f100e5bc7da
Instruction ID: 9600784f4e35fca091c34f390a3c5b1d77c7b45962217bcbe07eb841f0a473fc
Opcode Fuzzy Hash: 105c85825427e7c8ed203293b96c467a96f9bba36c05be2648f83f100e5bc7da
Instruction Fuzzy Hash: 22919230A0CAA94BEB54EB29D8947AB73E1FF94301F04456FD98BC7191DF78E9018782

Function 000001E4D586CDF4 Relevance: 4.6, APIs: 3, Instructions: 110
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE ref: 000001E4D586CEA7
BindIoCompletionCallback.KERNEL32 ref: 000001E4D586CEDE
ConnectNamedPipe.KERNELBASE ref: 000001E4D586CEEF

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: NamedPipe$BindCallbackCompletionConnectCreate
String ID:
API String ID: 2502124517-0
Opcode ID: 1f39a579d535edce93b33f8ad890ac1eeea552d42be0d6d7d28d92d913c1a808
Instruction ID: 18ca3de67087f648a17459ca5c36aaf0b9821094ad912160c310c1edd810a0ae
Opcode Fuzzy Hash: 1f39a579d535edce93b33f8ad890ac1eeea552d42be0d6d7d28d92d913c1a808
Instruction Fuzzy Hash: 2831B5706086488FE795EF68D8C4B9A77E4FB94310F104A29E45BC31D1DF78C955CB81

Function 00007DF4E2E92704 Relevance: 4.5, APIs: 3, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007DF4E2E92715
malloc.MSVCRT ref: 00007DF4E2E92731
NtQuerySystemInformation.NTDLL ref: 00007DF4E2E92755

Memory Dump Source

Source File: 00000006.00000002.2963967390.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: InformationQuerySystem$malloc
String ID:
API String ID: 1603438391-0
Opcode ID: eaf85d99e703aa885d9be82610ad3d8d03a394a4204a017367fdf17adc8f3dbe
Instruction ID: 82c05ab1a3219a2c622003c3720ad69048148ff31a53ec1b655bc15263829774
Opcode Fuzzy Hash: eaf85d99e703aa885d9be82610ad3d8d03a394a4204a017367fdf17adc8f3dbe
Instruction Fuzzy Hash: 8B013130B199559FEB85EF28DC68B6677E5FB94301F44012DE84BC21A0DF38D945CB42

Function 000001E4D5872C64 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 000001E4D5872CBC

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f6b0f352e34b93935ac2a1f97fa2b0892be8d0a68ee0d9962c8f94757f801c03
Instruction ID: b0acb87f28f548569e2ca384c465c08367bd5e31668b083d436b35dd7095110a
Opcode Fuzzy Hash: f6b0f352e34b93935ac2a1f97fa2b0892be8d0a68ee0d9962c8f94757f801c03
Instruction Fuzzy Hash: A7215171A049888FE750EF99ECC47BDB6D0F7E9351F60053EF94AC3250DB2889648785

Function 000001E4D5862628 Relevance: 3.3, APIs: 2, Instructions: 293
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 000001E4D586272E
SuspendThread.KERNELBASE ref: 000001E4D5862770

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: CloseHandleSuspendThread
String ID:
API String ID: 1038686644-0
Opcode ID: ee0b4b29cbf429cf193f7da3647d56e0b1a845656fd74a12addcfb7ee39e090b
Instruction ID: 89545360c0ff5f52dd04645c1fcff4c962e01e308bc1637b3740f5fcf45a4f51
Opcode Fuzzy Hash: ee0b4b29cbf429cf193f7da3647d56e0b1a845656fd74a12addcfb7ee39e090b
Instruction Fuzzy Hash: AD910130A08A55CBEB68DB58EC527BDB3D1FB65310F14499DE84BC6181DE39D862CBC2

Function 00007DF4E2EA22CC Relevance: 2.0, APIs: 1, Instructions: 450timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007DF4E2EA1290: RtlAddFunctionTable.KERNEL32 ref: 00007DF4E2EA12BD

Part of subcall function 00007DF4E2EA12C8: VirtualProtect.KERNELBASE ref: 00007DF4E2EA12F5

SetTimer.USER32 ref: 00007DF4E2EA2762

Memory Dump Source

Source File: 00000006.00000002.2964096876.00007DF4E2EA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2EA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2ea1000_wmlaunch.jbxd

Similarity

API ID: FunctionProtectTableTimerVirtual
String ID:
API String ID: 2248422592-0
Opcode ID: 907297c01f2e853a7e6e6be3efaf92a15819b9f7a160a726e89f0d05781fa5e1
Instruction ID: 90b0ae587b706d0b708b22168dfd0c9c3d04e0a0fc4a914d4d0bea04ce4dc50c
Opcode Fuzzy Hash: 907297c01f2e853a7e6e6be3efaf92a15819b9f7a160a726e89f0d05781fa5e1
Instruction Fuzzy Hash: BEE16470A0CA595FEB54EF28D8996AA77E1FF98300F14453EE48BC31A1DF34EA458B41

Function 000001E4D586C25C Relevance: 1.8, APIs: 1, Instructions: 560memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001E4D586C65C

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1463b6e579e83794cd598155eb9e3160b38bf0e3bcb0f61670329aaf0c67c5a2
Instruction ID: 697be9f45431d21744959a0915d1ec2acba845243478d9a6f438951a0bb50530
Opcode Fuzzy Hash: 1463b6e579e83794cd598155eb9e3160b38bf0e3bcb0f61670329aaf0c67c5a2
Instruction Fuzzy Hash: A3F12730A185A48FE72DAA6CEC862BD77D1F795301F28066EE8DBC2183DD28C55687C1

Function 000001E4D58729D4 Relevance: 1.8, APIs: 1, Instructions: 260nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E4D5872A94

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: f13696e1930880e2e19ebf6412232386b6a4ab7a0f564d2111b2459b68bcc0da
Instruction ID: 039ee4b5a513e446c7267ad68b2c7f1ec2b685c8e38a3eb8604f4a8602d99682
Opcode Fuzzy Hash: f13696e1930880e2e19ebf6412232386b6a4ab7a0f564d2111b2459b68bcc0da
Instruction Fuzzy Hash: 5B816130A18B89CBF7659A9AE8457AEF3D1FBA4300F504619FC47C3191EF68D86186C2

Function 000001E4D58727B8 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E4D5872807

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d9381645012d00cf6e7f8dfe8da443d67e907387f0873f85681973196ff3555c
Instruction ID: fbc5145336ca11d2cf533d1c33e79f8feddc6bd87e78d4ddc6c52adccc6a6e22
Opcode Fuzzy Hash: d9381645012d00cf6e7f8dfe8da443d67e907387f0873f85681973196ff3555c
Instruction Fuzzy Hash: 7BF0DA74E18B848FDB64EF2CD889B9AB7E0FBA9300F60451DE84CC3245DB34D8548B86

Function 000001E4D5872990 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E4D58729BA

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 98d03459468cdcd74854b97b597847e55f0ea75636d4913b4c299d0c762e3800
Instruction ID: 0407b061f687ecde3680a9ab4b56c935a47380dd2edfde1f508f3a08ed1f2d0e
Opcode Fuzzy Hash: 98d03459468cdcd74854b97b597847e55f0ea75636d4913b4c299d0c762e3800
Instruction Fuzzy Hash: B9E065716086448FDB00DF94DCC1A69B3E4F795304F444D29E84AC6164D664D558C692

Function 000001E4D587252C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E4D587254D

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 27a0ab9b8b81d19b55a36d5b88940b5d877d47714e961321c564cf766a84aa8c
Instruction ID: 358f561c18ee16c1b65c467dfbb818f3f7faf6603d54546b3f4ec0269806e8ea
Opcode Fuzzy Hash: 27a0ab9b8b81d19b55a36d5b88940b5d877d47714e961321c564cf766a84aa8c
Instruction Fuzzy Hash: 0DD01234E18B858BD750EB6DD9416097BE2B7D9314F544618FC4983310E73CD4518686

Function 000001E4D587288C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E4D58728A7

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1d483c746a178fd7cebb358bd60c8d391381be698edd62c71eedc0381d53c554
Instruction ID: bbbc4fd27c7f832e60d32a0a8e0e26b9403eedfc8c86cfbc275f3f9dc95e366c
Opcode Fuzzy Hash: 1d483c746a178fd7cebb358bd60c8d391381be698edd62c71eedc0381d53c554
Instruction Fuzzy Hash: A0D05E34E28B898BEA10B7699D4160976E1F7A5308F904608AC49C2254DA3ED42042C2

Function 000001E4D58728B8 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E4D58728D9

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: bd75e34d41d0a0c218f00c4b384fa59cf13494ae4b0fc6bee219bc2a66024f0a
Instruction ID: 9d0374bf23e0b42e1fe5fa46124e2bffa8f5d7cbef21e8e0105894add0ffa105
Opcode Fuzzy Hash: bd75e34d41d0a0c218f00c4b384fa59cf13494ae4b0fc6bee219bc2a66024f0a
Instruction Fuzzy Hash: 7AD01234D587858BD610AB69DC416097BE1BBD9314F644618F88583314E73DD4518786

Function 000001E4D5872418 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E4D5872428

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 2134b33d09b848e70ba1f23de37cfdd97cd4e92c7083e33fbb9b34bfa8345c36
Instruction ID: 7f4645e95c623f6adc1c3bfaa2351e9af6533fe515f7f10df7018b8bd4aed441
Opcode Fuzzy Hash: 2134b33d09b848e70ba1f23de37cfdd97cd4e92c7083e33fbb9b34bfa8345c36
Instruction Fuzzy Hash: AEC04C24E1584B9BE96562FBDD8175D61D0B7AA354FC50010BC0AC2180FA4DD9F543D6

Function 000001E4D58728E8 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,?,000001E4D586531B), ref: 000001E4D58728F8

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 14fbc5d4ea2d13eb613c5f0cfb1986910ad3174e43fd425e2ce4bb45159b65c3
Instruction ID: 1f2e5740ed697fbc1bac6ced27096bba0b4b5d794e2d37abbf0e7e31109767a0
Opcode Fuzzy Hash: 14fbc5d4ea2d13eb613c5f0cfb1986910ad3174e43fd425e2ce4bb45159b65c3
Instruction Fuzzy Hash: 1CC04C24A19D4F9BE954A2EA9D82B5C6290B759354FC40400AC16C2180EE1DD5F453D6

Function 00007DF4E2E91438 Relevance: 6.1, APIs: 4, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007DF4E2E91497
RegQueryValueExW.KERNELBASE ref: 00007DF4E2E914E6
RegCloseKey.KERNELBASE ref: 00007DF4E2E9150C
GetVolumeInformationW.KERNELBASE ref: 00007DF4E2E91570

Memory Dump Source

Source File: 00000006.00000003.2059711361.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: CloseInformationOpenQueryValueVolume
String ID:
API String ID: 4069062851-0
Opcode ID: 3ebb744f0aebbecadcf06631c3d65907a1788fb7df7ced3004579ef494ef68f9
Instruction ID: a925cc71a0a5f605faf97d6b66eebb1aab1090fad56108b1d9d98fefca269659
Opcode Fuzzy Hash: 3ebb744f0aebbecadcf06631c3d65907a1788fb7df7ced3004579ef494ef68f9
Instruction Fuzzy Hash: 28413F3051CA588BE755EB28D899BDBB3F1FB94305F004A6FE48BC6191DF78D6048B42

Function 000001E4D5877DA0 Relevance: 6.1, APIs: 4, Instructions: 130
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 000001E4D5877DA9
socket.WS2_32 ref: 000001E4D587B24B
getsockopt.WS2_32 ref: 000001E4D587B27F
socket.WS2_32 ref: 000001E4D587B2B4

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: socket$ErrorModegetsockopt
String ID:
API String ID: 552242919-0
Opcode ID: 3bad8950bc8ed42d49e75fcab8a12e6def80f6fb96da2e8da31b13afe45452c3
Instruction ID: d0d784fdea340f89bd5958c49da2ae5d646d3a31854a7e72fbd0b7703f573f65
Opcode Fuzzy Hash: 3bad8950bc8ed42d49e75fcab8a12e6def80f6fb96da2e8da31b13afe45452c3
Instruction Fuzzy Hash: 83418730618689CFE755EF29EC986AA77E2FBA8300F50463DE447C32A1DF788515CB81

Function 000001E4D586DFC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001E4D586E047
VirtualProtect.KERNELBASE ref: 000001E4D586E070

Strings

rE\, xrefs: 000001E4D586DFDC

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: fd197d1d460a7a7097ebc69198cfe8898b84731961e3c45740b5833891c72836
Instruction ID: 030cdde3b42dc04f40dcd096b1cbdd90cbfe0e26f2f907d1949f7c574faf3f6b
Opcode Fuzzy Hash: fd197d1d460a7a7097ebc69198cfe8898b84731961e3c45740b5833891c72836
Instruction Fuzzy Hash: 761186317049484BEB45FB58E8D5BED72D6F7E4341F504929A80BC3286EE2CD9658782

Function 000001E4D586BBF0 Relevance: 4.6, APIs: 3, Instructions: 110
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingW.KERNELBASE ref: 000001E4D586BC4C
MapViewOfFile.KERNELBASE ref: 000001E4D586BC6E
CloseHandle.KERNELBASE ref: 000001E4D586BCE6

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: File$CloseHandleMappingOpenView
String ID:
API String ID: 2553196624-0
Opcode ID: 8bb8605ac1c349b7ed951fd2da0efd1c73228fe5391c7a5f19e2fcd3618d3200
Instruction ID: 34302f5f58e45f481d79d0bf4b49e8e485b4702574b94ec95b3f592c165d52ca
Opcode Fuzzy Hash: 8bb8605ac1c349b7ed951fd2da0efd1c73228fe5391c7a5f19e2fcd3618d3200
Instruction Fuzzy Hash: 5731A431A14948CFEB55FF64E8866EEB3D4FBA4301F50493AA84BC3191DE34D6698782

Function 000001E4D586B9D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 000001E4D586BB1F

Strings

P, xrefs: 000001E4D586BA46

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: CreateWindow
String ID: P
API String ID: 716092398-3110715001
Opcode ID: 3958d680dd61ed40200acf61cd907bfc270c34c5250da5fbb8d7e78c828db693
Instruction ID: 55b81a23924ab74911e205e35c424e30ddfb91ee7e59da7c55b892f03d815dc1
Opcode Fuzzy Hash: 3958d680dd61ed40200acf61cd907bfc270c34c5250da5fbb8d7e78c828db693
Instruction Fuzzy Hash: B0514D70518B448FE7A5EF68E88679AB7E4FBA5311F108A2EE48EC3150DF349545CB83

Function 00007DF4E2E93018 Relevance: 3.3, APIs: 2, Instructions: 297
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007DF4E2E91708: RtlAddFunctionTable.KERNEL32 ref: 00007DF4E2E91735

Part of subcall function 00007DF4E2E91740: VirtualProtect.KERNELBASE ref: 00007DF4E2E9176D

calloc.MSVCRT ref: 00007DF4E2E9313A
SendMessageA.USER32 ref: 00007DF4E2E931FB

Memory Dump Source

Source File: 00000006.00000002.2963967390.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: FunctionMessageProtectSendTableVirtualcalloc
String ID:
API String ID: 2453823186-0
Opcode ID: 06791c2761ba3497e0c9077ab5921302019734c58a86a701aa2be8a22ea6a1e2
Instruction ID: c18a088466affe3271033aa5eef5474e821274f1552b47bebd7d2a1152c4e418
Opcode Fuzzy Hash: 06791c2761ba3497e0c9077ab5921302019734c58a86a701aa2be8a22ea6a1e2
Instruction Fuzzy Hash: 03917530A0CAA84FEB54EB6CD4956AA73F2FB54300B50467FD48FC3191DA38E945CB81

Function 000001E4D58622D0 Relevance: 3.2, APIs: 2, Instructions: 222
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 000001E4D58622E8
VirtualAlloc.KERNELBASE ref: 000001E4D58623B4

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 9420d4d47bb5eb7f06d7fea4bf54311970c83033f74d5905fb72208c54926d5e
Instruction ID: 75136da8590d6f651266ebaa72120334df28939dccbf6ebe6093497834562c09
Opcode Fuzzy Hash: 9420d4d47bb5eb7f06d7fea4bf54311970c83033f74d5905fb72208c54926d5e
Instruction Fuzzy Hash: EB51EB30A18E4D8FE755EB9CE8483ADB2D1F7A8301F104569F84AC3194EE78C86187C1

Function 000001E4D586D594 Relevance: 3.1, APIs: 2, Instructions: 132
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 000001E4D586D5D8
CloseHandle.KERNELBASE ref: 000001E4D586D62C

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: CloseFileHandleView
String ID:
API String ID: 3964672402-0
Opcode ID: f5e4ace49f8dbf4d208ab68c6c07d1c08f373a7b01313fe5be4b999b6ef0fbb6
Instruction ID: eef40b59e9f28b08aa22ee9943d46f4eb6ff2cd5b3dff651e03162a8aa63f9af
Opcode Fuzzy Hash: f5e4ace49f8dbf4d208ab68c6c07d1c08f373a7b01313fe5be4b999b6ef0fbb6
Instruction Fuzzy Hash: C8418131A15948CFE755FFA8EC85BAE73A4FBA5305F004919B80AC3195DF28D8658BC1

Function 000001E4D5862974 Relevance: 3.1, APIs: 2, Instructions: 97
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001E4D58629B3
VirtualProtect.KERNELBASE ref: 000001E4D5862A19

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9af94119fb7637b7a971dd9e5dfe6689dbe62cc4b897151fb24c5dcbfab40a36
Instruction ID: 7fae4a4fce34a10dc8e3f352e36d053c373dc057891cef3bf81d3d1fdf4fd9c0
Opcode Fuzzy Hash: 9af94119fb7637b7a971dd9e5dfe6689dbe62cc4b897151fb24c5dcbfab40a36
Instruction Fuzzy Hash: 6D314D307086854BEB149F6CEC947997BC0FBAA315F1502D5EC8AC72C5DB58C812C382

Function 00007DF4E2E912C8 Relevance: 3.1, APIs: 2, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF4E2E912F5
VirtualProtect.KERNELBASE ref: 00007DF4E2E9137E

Memory Dump Source

Source File: 00000006.00000003.2059711361.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 89563af4fe1d572c43706a2c5b782feb3df9d02bfd1ff06021ce1d81ad062eb6
Instruction ID: 0a8a9de29404f1a01adc9f6428d06ee0e3b35d27ac8d5b58f23a56dff433b095
Opcode Fuzzy Hash: 89563af4fe1d572c43706a2c5b782feb3df9d02bfd1ff06021ce1d81ad062eb6
Instruction Fuzzy Hash: D521E121A086B547DB18DB2C944077AB3F1FF90340F1901BFEC8BCBA85D668EA018245

Function 00007DF4E2E91740 Relevance: 3.1, APIs: 2, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007DF4E2E9176D
VirtualProtect.KERNELBASE ref: 00007DF4E2E917F6

Memory Dump Source

Source File: 00000006.00000002.2963967390.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 555ee51bdfbe110a30625e9d65cd405c650e6e50b938efdbc78372c29de57681
Instruction ID: d3830538a3d1ab6ffdce1d404336811645ecf6664e18d635a29cf59116527687
Opcode Fuzzy Hash: 555ee51bdfbe110a30625e9d65cd405c650e6e50b938efdbc78372c29de57681
Instruction Fuzzy Hash: 5F21D135E086B647EB189B2C9484777B3F1FF95300F1841AFE88BCB285D66AEA418245

Function 00007DF4E2EA12C8 Relevance: 3.1, APIs: 2, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007DF4E2EA12F5
VirtualProtect.KERNELBASE ref: 00007DF4E2EA137E

Memory Dump Source

Source File: 00000006.00000002.2964096876.00007DF4E2EA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2EA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2ea1000_wmlaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aa55061d99e775b82e27cc6da46f8fa59da2ee6fc95db4891e67f0932caa2168
Instruction ID: 451bef0a85dc0385057bccec7770105dce8dd9d18cfac27883b0ada947f8ca95
Opcode Fuzzy Hash: aa55061d99e775b82e27cc6da46f8fa59da2ee6fc95db4891e67f0932caa2168
Instruction Fuzzy Hash: FD21F3B5A085A567EF188F2C8440776B3F5FF90340F19493EECCBCBA85D768EA098255

Function 000001E4D58A4468 Relevance: 2.5, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000001E4D58A4496
free.MSVCRT ref: 000001E4D58A44A0

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5a17d2a82900e38e66e0587de357cfea25c88adc918405c2cab64094945da2f0
Instruction ID: f3854041c8b5fdf123733cc8c20ff48b385028c020d4d312999ab28f3ebeebf2
Opcode Fuzzy Hash: 5a17d2a82900e38e66e0587de357cfea25c88adc918405c2cab64094945da2f0
Instruction Fuzzy Hash: A5F0127061AD0A8FEF94DBA9D884B6533D1FF68310F601154A819C7195EE69DC61C784

Function 00007DF4E2E915E8 Relevance: 1.7, APIs: 1, Instructions: 228COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE ref: 00007DF4E2E9172D

Memory Dump Source

Source File: 00000006.00000003.2059711361.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: a4d7378eb0dc183d45dac9fde789c38604b4b9a60361aa9a1ccba498305d516d
Instruction ID: e903368c35c2fcb491b6faafcc44427fa912e22e51a468cbf4796fecb646537d
Opcode Fuzzy Hash: a4d7378eb0dc183d45dac9fde789c38604b4b9a60361aa9a1ccba498305d516d
Instruction Fuzzy Hash: 78716370A1C7984FD775DB28D4857ABB7E1FB94300F044A6FE9CFC2156EA34A9058B82

Function 000001E4D586CA8C Relevance: 1.7, APIs: 1, Instructions: 228fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 000001E4D586CC99

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e26a3d902f64fdb1e6a29b1ddfd8af137ced715061d327bbcfc87f3b72d7e64f
Instruction ID: 76ef7df1460174c792d69b4b7d805e9e450b5b9de8c7e09e73f674298d1030e4
Opcode Fuzzy Hash: e26a3d902f64fdb1e6a29b1ddfd8af137ced715061d327bbcfc87f3b72d7e64f
Instruction Fuzzy Hash: 4871EC71608B48CFE769EB58EC916A973E1F7A4710F100A1DE88BC3192DF38E96587C1

Function 000001E4D5866C10 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE ref: 000001E4D5866CD6

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c27442c9625b69612e30a0c621dafdc38b3cd1b2ea33eefe8ec2cdf5f7c33623
Instruction ID: b6506c57431d2e4aa620951cf2f08b3bc1b37dd9fcf30c23a9372adb6c6f9000
Opcode Fuzzy Hash: c27442c9625b69612e30a0c621dafdc38b3cd1b2ea33eefe8ec2cdf5f7c33623
Instruction Fuzzy Hash: 1C416230B14A888BEB59A775EC917EE32D5FBA4310F400A29BC57C31D2DE3DD9318681

Function 000001E4D586778C Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 000001E4D58678B2

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: c6fe4b8a49b1c432d16a5d1b2244a4336856686fe2f0bc0d983b446ba2d85ae3
Instruction ID: 23bd57db4b7b396ca6b86a14e730e89e9267081478e9c08b4b5577e0a95ca850
Opcode Fuzzy Hash: c6fe4b8a49b1c432d16a5d1b2244a4336856686fe2f0bc0d983b446ba2d85ae3
Instruction Fuzzy Hash: 91413F715187888BE76AEF64D895BDFB3E0FBA4300F004A1DB48AC3191EF799555CB82

Function 000001E4D586CCD0 Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 000001E4D586CD2F

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2f464fde3477c0bba4832f44d3340180ae7d23497e5ed422822a87f1e6a42210
Instruction ID: c06b73133f0adb775b0aa29726324f9d30d463b1b510bfabb8cb697fc8bf1a56
Opcode Fuzzy Hash: 2f464fde3477c0bba4832f44d3340180ae7d23497e5ed422822a87f1e6a42210
Instruction Fuzzy Hash: 9A01C471604A4C8FEB40FB59D8819ADB3E9FBE8310F50062AF84AC2150EF24EA648781

Function 000001E4D5862904 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 000001E4D586293C

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a3e65a005f3911c52a3a19618f507bf36bcbd5794d57615cb3bbd7cad2f75c67
Instruction ID: 4f4db30616662dab7cad42c73bcc8d73244d56ff3c335ade39aba1dd15fac5ed
Opcode Fuzzy Hash: a3e65a005f3911c52a3a19618f507bf36bcbd5794d57615cb3bbd7cad2f75c67
Instruction Fuzzy Hash: E5012B31B149098FFB54EBADEC58A6973D1FBCA316B4444A5E80AC7144D93D9C51CB81

Function 00007DF4E2E92F60 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetWinEventHook.USER32 ref: 00007DF4E2E92FCD

Memory Dump Source

Source File: 00000006.00000002.2963967390.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: EventHook
String ID:
API String ID: 3661607649-0
Opcode ID: e6b188324f96a1e03f166e4287a2793acb406422b2b30f8b11d607c185f61fee
Instruction ID: 62779e3cd5725f144c719e76fb7146cad81387ad864168eb9451a35ad2de85f0
Opcode Fuzzy Hash: e6b188324f96a1e03f166e4287a2793acb406422b2b30f8b11d607c185f61fee
Instruction Fuzzy Hash: 14115230C1CA654FEB54AB6CD86979773A0FB10314F5006AED8CBC21D2DB3D96549741

Function 000001E4D586BE7C Relevance: 1.5, APIs: 1, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001E4D586BED6

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4d57d7d5982399080f90361c2699a999889f8feb933735bc5bb6e787f07df0d3
Instruction ID: 8caaea2960b173859fdfc6c6d16777ef8d3a400675e51812bb68f9ffdc3d38f3
Opcode Fuzzy Hash: 4d57d7d5982399080f90361c2699a999889f8feb933735bc5bb6e787f07df0d3
Instruction Fuzzy Hash: 01018630714A8C8FF745EBB9E8553AD3295F774301F10056AA45AC3291EE28CD248781

Function 000001E4D5862B50 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 000001E4D5862B70

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: eab2b32177be9564e25d5777707ea1ca30621b5695f0306aefe172fe800bc35c
Instruction ID: a72ed7b835505938c42463304d4c5075635e5336114dc3df75171f5d70d66d2e
Opcode Fuzzy Hash: eab2b32177be9564e25d5777707ea1ca30621b5695f0306aefe172fe800bc35c
Instruction Fuzzy Hash: 79F08C31E05A48CFF720AFB6AC943AE6242F399312F244D7AA806C6181DC2D88618380

Function 000001E4D586697C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000001E4D58669A3

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: c691d5039295ecc8b7e044fb40fc3c69618cf93c91779b6bda279d67736a12d8
Instruction ID: db24ac487985b8fc0403e4b577207fc6bbe5bebfc894342dae4e40fc26c3f624
Opcode Fuzzy Hash: c691d5039295ecc8b7e044fb40fc3c69618cf93c91779b6bda279d67736a12d8
Instruction Fuzzy Hash: F7E0C231B04C190BAB6861EE688CABA11C6D7EC273704027BF82DC3299ED14CC614381

Function 00007DF4E2E91290 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF4E2E912BD

Memory Dump Source

Source File: 00000006.00000003.2059711361.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: fc492990cf9c193ed0fed28dab1318ef1c2e9243cee28bd6a774944ac56baf31
Instruction ID: 914a42bf43f215a8ffaecb402dadf1066bf7bf79f72cd53b0bb9474fb330497a
Opcode Fuzzy Hash: fc492990cf9c193ed0fed28dab1318ef1c2e9243cee28bd6a774944ac56baf31
Instruction Fuzzy Hash: 79E04F30A049055BEB98E61DC80A7503AE0EB5830AF6446AEE509C9291CB79949BCF81

Function 000001E4D5863C84 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 000001E4D5863CB1

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: a4029a93bfcd341c8676454adb8c6f5f12b6913b14ed0bccef0902b234b6dd47
Instruction ID: 426f19054781715fa83d28ea862aceffae418ee2db1a3756acba046b29e3316d
Opcode Fuzzy Hash: a4029a93bfcd341c8676454adb8c6f5f12b6913b14ed0bccef0902b234b6dd47
Instruction Fuzzy Hash: D7E04F305009059BEB98DB5DC90939036D1FBA830AF604258E805CA295CF39C4ABCF81

Function 000001E4D58674A0 Relevance: 1.5, APIs: 1, Instructions: 276COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000001E4D586757E

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef59572018a9deb8cc9717970e2f4ccce5bc515e763955c946e33fff9a11c9f9
Instruction ID: 021576027e465d3a6de8dbc8412980cba424e110f1a0e29c164d918884c09610
Opcode Fuzzy Hash: ef59572018a9deb8cc9717970e2f4ccce5bc515e763955c946e33fff9a11c9f9
Instruction Fuzzy Hash: D9917430618A48CFEB45EF58E885AEA73E0FB65300F444959F84AC7196DF34E865CBC2

Function 00007DF4E2E91708 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF4E2E91735

Memory Dump Source

Source File: 00000006.00000002.2963967390.00007DF4E2E91000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2E91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2e91000_wmlaunch.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: 62df2a061ef9a83e40c3da8f8fbf33d98cfabe8aaf6c816d3fbd47a45bbcd3fe
Instruction ID: 19c4627c39d8cd815ec0c15a17285c3cb1756c08bc53c3b994ace9c11b7d6eec
Opcode Fuzzy Hash: 62df2a061ef9a83e40c3da8f8fbf33d98cfabe8aaf6c816d3fbd47a45bbcd3fe
Instruction Fuzzy Hash: 0EE04F305409064BEBA8E61DC84975036E0EB58306F6442AEE845CA291CB3A94ABCF42

Function 00007DF4E2EA1290 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF4E2EA12BD

Memory Dump Source

Source File: 00000006.00000002.2964096876.00007DF4E2EA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF4E2EA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7df4e2ea1000_wmlaunch.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: cff89ce48d21670ef986fb34dbe231ab83686b2b911df37c38ad495f9c0b2048
Instruction ID: 208293fc779fc9773fd4b652b676f959d237cbfef7e1e87d9abe6e25592977e8
Opcode Fuzzy Hash: cff89ce48d21670ef986fb34dbe231ab83686b2b911df37c38ad495f9c0b2048
Instruction Fuzzy Hash: FAE04F309049055BEBA8D61DC8097513AE0EB5C306F64466DE549C9291CB39D89BCF81

Function 000001E4D5866950 Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001E4D5866972

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: 57345c5b8ac80cea3d397ea132a2b7e2c5f6dc24ece6ad7bb9ffd4d27ab807e0
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 3DD05E30720D0D5BEB48636E6C953695195E7D8321F50063AB81AC2286DD58CC660280

Function 000001E4D586A76C Relevance: 1.4, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000001E4D586A7FB

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: d2cb0783aaccdf533b8783a245833ea662784d452517a49626c29c14fb2d72e4
Instruction ID: d010eff9253f35ac1e857885ea84a31d25e76e42c6c086b9455b3a50ff447246
Opcode Fuzzy Hash: d2cb0783aaccdf533b8783a245833ea662784d452517a49626c29c14fb2d72e4
Instruction Fuzzy Hash: 7141A531614D0ECFDB94EF6CD889AA9B7E1FB78311710466AE409C3660DB34E8A1CBC0

Function 000001E4D587D4AC Relevance: 1.3, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000001E4D587D4FE

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e53db298d0d7d8de9701e8a24c72cb59212fc55ca396913229799ff2ccd7724d
Instruction ID: 489bd719038e62d7dd4a4f108b79d10e1d98dfeeca7c4ee950d9b2bd9cb2f3e0
Opcode Fuzzy Hash: e53db298d0d7d8de9701e8a24c72cb59212fc55ca396913229799ff2ccd7724d
Instruction Fuzzy Hash: 5A116D30A02959CFEFA59FAAE8843A933D0FB68315F04017AEC09CA195CB348C65C7D1

Function 000001E4D586A960 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,-00000002,000001E4D5870CE7), ref: 000001E4D586A976

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 85df9ee76aeee916477ee65bd03fae0aa34298d7a375d21a792168504e9e5af9
Instruction ID: 9dcda15875b4b7c68397ac39a50f232c4eb9fb6d04be5b10bcfa442ecec69867
Opcode Fuzzy Hash: 85df9ee76aeee916477ee65bd03fae0aa34298d7a375d21a792168504e9e5af9
Instruction Fuzzy Hash: D3F09030210E0ECFEB89EF69D8D8769B3E0FB68305F600929D519C2590CB749C60CB41

Function 000001E4D5864998 Relevance: 1.3, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 000001E4D58649CB

Memory Dump Source

Source File: 00000006.00000002.2962577263.000001E4D5861000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E4D5861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1e4d5861000_wmlaunch.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: f09fa07cc6f9e6f5b53de74bb20c91754370ab02738bba199ca246931610d18a
Instruction ID: 0795817357728bbe5ca8a53b3ffa464e1bdee27524f4693aedd120b60cc5b24f
Opcode Fuzzy Hash: f09fa07cc6f9e6f5b53de74bb20c91754370ab02738bba199ca246931610d18a
Instruction Fuzzy Hash: 37F08274690D098FF7849F6CEC9876936E5FBA9302F55046AA809C72B0DE78CCB58741

Analysis Process: dllhost.exePID: 7760, Parent PID: 7720COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	61
Total number of Limit Nodes:	0

Executed Functions

Function 000002D392A3385C Relevance: 1.8, APIs: 1, Instructions: 269
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002D392A33484: GetVolumeInformationW.KERNELBASE ref: 000002D392A335BB

NtQuerySystemInformation.NTDLL ref: 000002D392A339CF

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: Information$QuerySystemVolume
String ID:
API String ID: 2187445334-0
Opcode ID: bbe3e2a7d344cf85ec3a4c395e4fae651ef179c001aa808880b53e11515cf003
Instruction ID: 07331b997c9316363d8fbcb6c6506f5728f9ac6ab6d10f8b1ecae08d5f5da4a1
Opcode Fuzzy Hash: bbe3e2a7d344cf85ec3a4c395e4fae651ef179c001aa808880b53e11515cf003
Instruction Fuzzy Hash: 9591C431108E094FE795EB34D859AEA73E1FB54341F408A2BD45BC32A1EF74DA418782

Function 000002D392A32AC4 Relevance: .3, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2ab5fabc2a0e36146663c7120b09b4177702f3456a2b2b11960e1abc9f1dee
Instruction ID: a1aaaa8f31cf3a8ad5264459d700d23b63c6e642bae97994e29134c50f0c1aad
Opcode Fuzzy Hash: 0f2ab5fabc2a0e36146663c7120b09b4177702f3456a2b2b11960e1abc9f1dee
Instruction Fuzzy Hash: 50B18636118F095BE786EB14C8A5FDA73E1FBA4340F40461AA897C7196DE74EF05CB82

Function 000002D392A56E1C Relevance: 6.1, APIs: 4, Instructions: 130
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 000002D392A56E25
socket.WS2_32 ref: 000002D392A5A42B
getsockopt.WS2_32 ref: 000002D392A5A45F
socket.WS2_32 ref: 000002D392A5A494

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: socket$ErrorModegetsockopt
String ID:
API String ID: 552242919-0
Opcode ID: 2b6fb284fe353a32addd25f3df84090d0ecaa741c51bc7f7119ce81397f063fd
Instruction ID: 73a52e3ac517f12f0223f74255c65cd549382ae7d83f7d3d716e4427dab663ed
Opcode Fuzzy Hash: 2b6fb284fe353a32addd25f3df84090d0ecaa741c51bc7f7119ce81397f063fd
Instruction Fuzzy Hash: F2413335618A489FE794EF28E89CA9A77F1FB98300F40872EE446C32E5DF788504CB41

Function 000002D392A33658 Relevance: 3.2, APIs: 2, Instructions: 176
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 000002D392A33792
MapViewOfFile.KERNELBASE ref: 000002D392A337B9

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: bece0600f44f861c643c7654aa2f2e3f03c84c914f92a664447b07396d3fe0fc
Instruction ID: a32c51fd6490179ea121ad1b213026cbb39d9bbfcf4fbf9c702949619557b600
Opcode Fuzzy Hash: bece0600f44f861c643c7654aa2f2e3f03c84c914f92a664447b07396d3fe0fc
Instruction Fuzzy Hash: 2551A43111CB889BD765EB28C895BEAB7E0FB95301F40452FE8DAC2191DF749A05CB93

Function 000002D392A579E0 Relevance: 3.1, APIs: 2, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIoCompletionPort.KERNELBASE ref: 000002D392A57A42
SetFileCompletionNotificationModes.KERNEL32 ref: 000002D392A57A88

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: Completion$CreateFileModesNotificationPort
String ID:
API String ID: 3755109111-0
Opcode ID: 84be1d14cb65808509a283a73e814be659c70036e97280a94885828e4d56e97e
Instruction ID: e8cf66db868c8f2f7c7394bd79f3da408ab10f0f3dafe389d54514112db835a0
Opcode Fuzzy Hash: 84be1d14cb65808509a283a73e814be659c70036e97280a94885828e4d56e97e
Instruction Fuzzy Hash: 1631B0352049155FFBE8DB28DCACBBE32E4F754315F90406AF906D21D2DE61CE418782

Function 000002D392A33484 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE ref: 000002D392A335BB

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: cbef5665e4e33130d77fabd6912371dd21022a2eb90503feaf05fbace3e60585
Instruction ID: ee1a91c70c56006680601af54dfebaa187941c73ae24f8ffe1837c54d6f056c3
Opcode Fuzzy Hash: cbef5665e4e33130d77fabd6912371dd21022a2eb90503feaf05fbace3e60585
Instruction Fuzzy Hash: 04513835118B484FE769DB24C4A9BDBB3F1FB94340F404A1EE48AC3191DF759A05C742

Function 000002D392A57DD0 Relevance: 1.6, APIs: 1, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 000002D392A57DFD

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 164deb1e36558be1443e0572fd883e2d2b2af36008d1889a4b6708111c61d883
Instruction ID: 626477d91906560e6ec6d09b9e1ac86a8ddbfeeebf687fb1eec57cbc32e64805
Opcode Fuzzy Hash: 164deb1e36558be1443e0572fd883e2d2b2af36008d1889a4b6708111c61d883
Instruction Fuzzy Hash: D4210731304A044FEB88DB38DC9DBAA33E1FB54325F60466AEC2AD72D1DF648D014692

Function 000002D392A328D4 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 000002D392A32949

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 147b7861b8d55a5ae4162ffc4259640c3a28b81395385b0f304c643425426fcc
Instruction ID: 35501baf68d3641534ac40f75a67cd35073b3f03cf833ac3d57dd3a0f4b022d1
Opcode Fuzzy Hash: 147b7861b8d55a5ae4162ffc4259640c3a28b81395385b0f304c643425426fcc
Instruction Fuzzy Hash: 0E01A13A310E096AEBD8F334C879BFD22C6FB94390F84412A6C0AC21C2DE98CF044742

Function 000002D392A328A0 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 000002D392A328C7

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: be8164fcd6bb8b439b0c6dd95cb79210c8cf986f476e4ea7066077b0df3d1665
Instruction ID: 4bb0bb5fde96332a8cccd7d1a8f2375c3ee033614117cd00c1b05daea22ef4f7
Opcode Fuzzy Hash: be8164fcd6bb8b439b0c6dd95cb79210c8cf986f476e4ea7066077b0df3d1665
Instruction Fuzzy Hash: 05E02B12704C0D1BABA8A2BE649CBB651C6D7EC273744427BF81CC3295ED50CC410391

Function 000002D392A32874 Relevance: 1.5, APIs: 1, Instructions: 24
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002D392A32896

Memory Dump Source

Source File: 00000007.00000002.2962230453.000002D392A30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002D392A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d392a30000_dllhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: d39f46dc824e2a43665ae1734093b4d61398058f501c4b31746b5fc85bc441da
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 0CD0A711320D0E2BEB88A33D5CA87B511C5F7DC325F90553BF809C2285ED98CD550301

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UGcjMkPWwW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
UGcjMkPWwW.exe

Function 00424E5A Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 89
memorystringCOMMON

Function 0042C146 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 004322CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
memoryCOMMON

Function 00428946 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00432098 Relevance: 2.7, APIs: 2, Instructions: 163
memoryCOMMON

Function 0042C211 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 004272D1 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 303
COMMONLIBRARYCODE

Function 004263D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Function 00428990 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Function 00426921 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre