Edit tour

Windows Analysis Report
TctqdRX5Wq.exe

Overview

General Information

Sample name:	TctqdRX5Wq.exe renamed because original name is a hash value
Original sample name:	04564c481b2b3c094bef173df90782f6fc83bd7a02c028024676ee1036d8fa1f.exe
Analysis ID:	1526561
MD5:	34ecbd07c675ebc57c044ec300621a2d
SHA1:	348846c91d64300811928ab1db473be7501fc921
SHA256:	04564c481b2b3c094bef173df90782f6fc83bd7a02c028024676ee1036d8fa1f
Tags:	exeuser-JAMESWT_MHT
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RHADAMANTHYS Stealer

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Dllhost Internet Connection

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

TctqdRX5Wq.exe (PID: 6048 cmdline: "C:\Users\user\Desktop\TctqdRX5Wq.exe" MD5: 34ECBD07C675EBC57C044EC300621A2D)

conhost.exe (PID: 3744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2128 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2836 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2936 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 3180 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

OpenWith.exe (PID: 2656 cmdline: "C:\Windows\system32\openwith.exe" MD5: 0ED31792A7FFF811883F80047CBCFC91)

OpenWith.exe (PID: 2872 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

setup_wm.exe (PID: 2656 cmdline: "C:\Program Files\Windows Media Player\setup_wm.exe" MD5: F32C225D11A5AF5906CF7C15FDA955E4)

dllhost.exe (PID: 5232 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

WerFault.exe (PID: 3848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 688 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 684 MD5: C31336C1EFC2CCB44B4326EA793040F2)

SIHClient.exe (PID: 2936 cmdline: C:\Windows\System32\sihclient.exe /cv gXqch/IrSkuvKvqIAnHVew.0.2 MD5: 8BE47315BF30475EEECE8E39599E9273)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 https://github.com/echocti/ECHO-Reports/blob/main/Malware%20Analysis%20Report/Rhdamanthys/Rhadamanthys-EN.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000002.1723676965.0000000003795000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000003.1735196079.0000000003010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000003.1764339472.0000000004979000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000005.00000002.1739918743.0000000004100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.1800884339.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: OpenWith.exe PID: 2656	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 2872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.TctqdRX5Wq.exe.3795570.0.raw.unpack	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0.2.TctqdRX5Wq.exe.3795570.0.unpack	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
6.3.OpenWith.exe.5400000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.3.OpenWith.exe.51e0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 135.181.4.162, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\dllhost.exe, Initiated: true, ProcessId: 5232, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739

Suricata Signatures

ETPRO JA3 HASH Suspected Malware Related Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T10:22:19.187045+0200	2854824	2	Potentially Bad Traffic	135.181.4.162	2423	192.168.2.4	49734	TCP
2024-10-06T10:22:29.593854+0200	2854824	2	Potentially Bad Traffic	135.181.4.162	2423	192.168.2.4	49738	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T10:22:07.778773+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	2423	192.168.2.4	49730	TCP
2024-10-06T10:22:19.187045+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	2423	192.168.2.4	49734	TCP
2024-10-06T10:22:29.593854+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	2423	192.168.2.4	49738	TCP
2024-10-06T10:22:35.593541+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49739	TCP
2024-10-06T10:22:42.152937+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49740	TCP
2024-10-06T10:22:48.742012+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49741	TCP
2024-10-06T10:22:55.352587+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49742	TCP
2024-10-06T10:23:01.928600+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49779	TCP
2024-10-06T10:23:08.529764+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49820	TCP
2024-10-06T10:23:15.108270+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49856	TCP
2024-10-06T10:23:21.683053+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49887	TCP
2024-10-06T10:23:28.262803+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49930	TCP
2024-10-06T10:23:34.884884+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	49973	TCP
2024-10-06T10:23:41.477069+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	50015	TCP
2024-10-06T10:23:48.947004+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	50016	TCP
2024-10-06T10:23:55.548051+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	50017	TCP
2024-10-06T10:24:02.112855+0200	2854802	1	Domain Observed Used for C2 Detected	135.181.4.162	443	192.168.2.4	50018	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1723676965.0000000003795000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g"}

Multi AV Scanner detection for domain / URL

Source: https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g

Virustotal: Detection: 11%

Perma Link

Multi AV Scanner detection for submitted file

Source: TctqdRX5Wq.exe	ReversingLabs: Detection: 76%
Source: TctqdRX5Wq.exe	Virustotal: Detection: 72%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: C:\Windows\System32\OpenWith.exe

Code function: 12_3_00007DF42F522258 CryptUnprotectData,

12_3_00007DF42F522258

Source: TctqdRX5Wq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50018 version: TLS 1.2

Source: TctqdRX5Wq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdby^ source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: OpenWith.exe, 00000006.00000003.1737864385.0000000005300000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737759699.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb2j source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: OpenWith.exe, 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: OpenWith.exe, 00000006.00000003.1736083769.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1736374528.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: OpenWith.exe, 00000006.00000003.1737123646.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737430559.0000000005380000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: OpenWith.exe, 00000006.00000003.1736083769.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1736374528.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: OpenWith.exe, 00000006.00000003.1737123646.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737430559.0000000005380000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: OpenWith.exe, 00000006.00000003.1737864385.0000000005300000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737759699.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: OpenWith.exe, 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	12_3_00007DF42F52E261
Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	12_2_000001C4B1600511
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 4x nop then dec esp	16_2_0000019168205641

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:2423 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:2423 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:2423 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49742
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49739
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49741
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49779
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49740
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49856
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49930
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49973
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49887
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:49820
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:50015
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:50018
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:50017
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 135.181.4.162:443 -> 192.168.2.4:50016

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 135.181.4.162:2423

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: caec7ddf6889590d999d7ca1b76373b6

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 135.181.4.162:2423 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 135.181.4.162:2423 -> 192.168.2.4:49738

Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.4.162

Source: C:\Windows\System32\OpenWith.exe

Code function: 12_3_00007DF42F554D8C WSARecv,

12_3_00007DF42F554D8C

Source: OpenWith.exe, OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B36E2000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1868874518.000001C4B36C8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873132909.000001C4B36E8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033626763.000001C4B36E1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088748736.000001C4B38C2000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B36C6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090989362.000001C4B38C3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869472379.000001C4B36C8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871264910.000001C4B36E8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B36E2000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088305060.000001C4B36E2000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B36D1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869999188.000001C4B36E8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1848670499.000001C4B36C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g
Source: OpenWith.exe, 00000006.00000002.1800181660.0000000002BAC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g(
Source: OpenWith.exe, 00000006.00000002.1801414267.000000000562A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0gkernelbasentdllkernel32GetProcessMitigation
Source: RegAsm.exe, 00000005.00000002.1739152797.000000000123C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://135.h
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: OpenWith.exe, 0000000C.00000003.1878159928.000001C4B3BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: OpenWith.exe, 0000000C.00000003.1878159928.000001C4B3BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: OpenWith.exe, 0000000C.00000003.2033593746.000001C4B36F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B36E2000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006573754.000001C4B36F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1879533287.000001C4B36F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088305060.000001C4B36F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B36EE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090897935.000001C4B36F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1906879801.000001C4B36F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B36EE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B36F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mic
Source: OpenWith.exe, 0000000C.00000003.1878512690.000001C4B36F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mic)
Source: OpenWith.exe, 0000000C.00000003.1872339760.000001C4B3641000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871542217.000001C4B398A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3BA0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1899631638.000001C4B3BAA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1876331692.000001C4B362B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: OpenWith.exe, 0000000C.00000003.1872339760.000001C4B3641000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871542217.000001C4B398A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3BA0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1899631638.000001C4B3BAA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1876331692.000001C4B362B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t.mc_id=EnterPK201694ba2e0b-6
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870663279.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 135.181.4.162:443 -> 192.168.2.4:50018 version: TLS 1.2

Source: OpenWith.exe, 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_49ad3b77-4

Source: OpenWith.exe, 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_32a9c546-9

Source: Yara match	File source: 6.3.OpenWith.exe.5400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.OpenWith.exe.51e0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 2656, type: MEMORYSTR

System Summary

.NET source code contains very large array initializations

Source: TctqdRX5Wq.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 433152

Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B30030C7 NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,RtlFreeHeap,RtlFreeHeap,	12_3_000001C4B30030C7
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52AF60 NtAcceptConnectPort,	12_3_00007DF42F52AF60
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52AF40 NtAcceptConnectPort,	12_3_00007DF42F52AF40
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52ADD4 NtAcceptConnectPort,	12_3_00007DF42F52ADD4
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52AE5C NtAcceptConnectPort,	12_3_00007DF42F52AE5C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52BE6C calloc,NtAcceptConnectPort,	12_3_00007DF42F52BE6C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52ACE8 NtAcceptConnectPort,	12_3_00007DF42F52ACE8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52BCC0 NtAcceptConnectPort,NtAcceptConnectPort,free,	12_3_00007DF42F52BCC0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52ACC8 NtAcceptConnectPort,	12_3_00007DF42F52ACC8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52AD14 NtAcceptConnectPort,	12_3_00007DF42F52AD14
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52AC0C NtAcceptConnectPort,	12_3_00007DF42F52AC0C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52C7CC NtAcceptConnectPort,	12_3_00007DF42F52C7CC
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52C70C NtAcceptConnectPort,	12_3_00007DF42F52C70C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52B498 NtAcceptConnectPort,calloc,DuplicateHandle,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,	12_3_00007DF42F52B498
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52C47C NtAcceptConnectPort,	12_3_00007DF42F52C47C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52D3C0 NtAcceptConnectPort,NtAcceptConnectPort,	12_3_00007DF42F52D3C0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52D2F4 NtAcceptConnectPort,NtAcceptConnectPort,	12_3_00007DF42F52D2F4
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52C10C NtAcceptConnectPort,	12_3_00007DF42F52C10C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_2_000001C4B1601A90 NtAcceptConnectPort,NtAcceptConnectPort,	12_2_000001C4B1601A90
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_2_000001C4B1600AC8 NtAcceptConnectPort,NtAcceptConnectPort,	12_2_000001C4B1600AC8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_2_000001C4B1601CD0 NtAcceptConnectPort,CloseHandle,	12_2_000001C4B1601CD0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_2_000001C4B16015AC NtAcceptConnectPort,	12_2_000001C4B16015AC
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_00007DF449D01CE8 CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF449D01CE8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_00007DF449D01958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF449D01958
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682127B8 NtAcceptConnectPort,	16_2_00000191682127B8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821288C NtAcceptConnectPort,	16_2_000001916821288C
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682128E8 NtAcceptConnectPort,	16_2_00000191682128E8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682128B8 NtAcceptConnectPort,	16_2_00000191682128B8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168212990 NtAcceptConnectPort,	16_2_0000019168212990
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682129D4 NtAcceptConnectPort,	16_2_00000191682129D4
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168212418 NtAcceptConnectPort,	16_2_0000019168212418
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168212C64 NtAcceptConnectPort,	16_2_0000019168212C64
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821252C NtAcceptConnectPort,	16_2_000001916821252C
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B385C NtQuerySystemInformation,	17_2_00000242782B385C

Source: C:\Windows\System32\SIHClient.exe	File created: C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP3B3A.tmp			Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	File created: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMPCDA8.tmp			Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B30024F7	12_3_000001C4B30024F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B3005E7C	12_3_000001C4B3005E7C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B300557C	12_3_000001C4B300557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B30058FC	12_3_000001C4B30058FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B300279C	12_3_000001C4B300279C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B3001BA6	12_3_000001C4B3001BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B3004A38	12_3_000001C4B3004A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_000001C4B3002C3C	12_3_000001C4B3002C3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F502634	12_3_00007DF42F502634
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5E9F68	12_3_00007DF42F5E9F68
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F539F4C	12_3_00007DF42F539F4C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F530F04	12_3_00007DF42F530F04
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F54FDE0	12_3_00007DF42F54FDE0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5F6DAC	12_3_00007DF42F5F6DAC
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5E3D84	12_3_00007DF42F5E3D84
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F511E54	12_3_00007DF42F511E54
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5EAE00	12_3_00007DF42F5EAE00
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5DEBE4	12_3_00007DF42F5DEBE4
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5A6C60	12_3_00007DF42F5A6C60
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F56DC54	12_3_00007DF42F56DC54
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F513C6C	12_3_00007DF42F513C6C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F505C24	12_3_00007DF42F505C24
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F515C08	12_3_00007DF42F515C08
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F579AE0	12_3_00007DF42F579AE0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F54FA94	12_3_00007DF42F54FA94
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F559B70	12_3_00007DF42F559B70
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F569B38	12_3_00007DF42F569B38
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F51FB24	12_3_00007DF42F51FB24
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5EFB04	12_3_00007DF42F5EFB04
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5FCB04	12_3_00007DF42F5FCB04
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F51D9F0	12_3_00007DF42F51D9F0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5E69A8	12_3_00007DF42F5E69A8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F55CA38	12_3_00007DF42F55CA38
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5EA8BC	12_3_00007DF42F5EA8BC
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F51F95C	12_3_00007DF42F51F95C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F52996C	12_3_00007DF42F52996C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F55B7B8	12_3_00007DF42F55B7B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5696E0	12_3_00007DF42F5696E0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5575E4	12_3_00007DF42F5575E4
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5695D0	12_3_00007DF42F5695D0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F55D594	12_3_00007DF42F55D594
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F50F624	12_3_00007DF42F50F624
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5EA4A0	12_3_00007DF42F5EA4A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5E8474	12_3_00007DF42F5E8474
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F552524	12_3_00007DF42F552524
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5DA3D4	12_3_00007DF42F5DA3D4
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F54F3B8	12_3_00007DF42F54F3B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F55A430	12_3_00007DF42F55A430
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5693F4	12_3_00007DF42F5693F4
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5443F8	12_3_00007DF42F5443F8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5F72C8	12_3_00007DF42F5F72C8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5EB318	12_3_00007DF42F5EB318
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F59E24C	12_3_00007DF42F59E24C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5720BC	12_3_00007DF42F5720BC
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5CA168	12_3_00007DF42F5CA168
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F55B104	12_3_00007DF42F55B104
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F57CFB4	12_3_00007DF42F57CFB4
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5FBFCC	12_3_00007DF42F5FBFCC
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F5EAF80	12_3_00007DF42F5EAF80
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F501058	12_3_00007DF42F501058
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F54F02C	12_3_00007DF42F54F02C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_2_000001C4B1600C5C	12_2_000001C4B1600C5C
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_0000019168401F40	16_3_0000019168401F40
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_0000019168403660	16_3_0000019168403660
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_000001916840027B	16_3_000001916840027B
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_000001916840170E	16_3_000001916840170E
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_0000019168402718	16_3_0000019168402718
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_00007DF449D02204	16_3_00007DF449D02204
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_00007DF449D04EFC	16_3_00007DF449D04EFC
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_00007DF449D0392C	16_3_00007DF449D0392C
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916820C25C	16_2_000001916820C25C
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168212D24	16_2_0000019168212D24
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168202628	16_2_0000019168202628
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916823A81C	16_2_000001916823A81C
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821D010	16_2_000001916821D010
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916822D854	16_2_000001916822D854
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168227094	16_2_0000019168227094
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168240874	16_2_0000019168240874
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682348D0	16_2_00000191682348D0
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168235918	16_2_0000019168235918
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916823F940	16_2_000001916823F940
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168220174	16_2_0000019168220174
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916823E984	16_2_000001916823E984
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916823F1D0	16_2_000001916823F1D0
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168240270	16_2_0000019168240270
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168217270	16_2_0000019168217270
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168233A38	16_2_0000019168233A38
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168243A4D	16_2_0000019168243A4D
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168234A50	16_2_0000019168234A50
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168215ADC	16_2_0000019168215ADC
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821E398	16_2_000001916821E398
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916823CC00	16_2_000001916823CC00
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168246434	16_2_0000019168246434
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168230478	16_2_0000019168230478
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821DCE4	16_2_000001916821DCE4
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916823ECE4	16_2_000001916823ECE4
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682014D0	16_2_00000191682014D0
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168226D18	16_2_0000019168226D18
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682355B0	16_2_00000191682355B0
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168240D90	16_2_0000019168240D90
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682395D4	16_2_00000191682395D4
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168234DE8	16_2_0000019168234DE8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821F618	16_2_000001916821F618
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168223EA4	16_2_0000019168223EA4
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168227684	16_2_0000019168227684
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00000191682286B4	16_2_00000191682286B4
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821BEB8	16_2_000001916821BEB8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168235EC8	16_2_0000019168235EC8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168216F24	16_2_0000019168216F24
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_0000019168233F70	16_2_0000019168233F70
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916821C750	16_2_000001916821C750
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D27554	16_2_00007DF449D27554
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D23D3B	16_2_00007DF449D23D3B
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D1F149	16_2_00007DF449D1F149
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D1BD49	16_2_00007DF449D1BD49
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D26927	16_2_00007DF449D26927
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D258F8	16_2_00007DF449D258F8
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D250D6	16_2_00007DF449D250D6
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D154C0	16_2_00007DF449D154C0
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D260A5	16_2_00007DF449D260A5
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D25456	16_2_00007DF449D25456
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D18C19	16_2_00007DF449D18C19
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D1DFEB	16_2_00007DF449D1DFEB
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D183BA	16_2_00007DF449D183BA
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D14F8A	16_2_00007DF449D14F8A
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D26B5B	16_2_00007DF449D26B5B
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D20F5A	16_2_00007DF449D20F5A
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D26F4A	16_2_00007DF449D26F4A
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D22F24	16_2_00007DF449D22F24
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D25AB2	16_2_00007DF449D25AB2
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D27A58	16_2_00007DF449D27A58
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D25227	16_2_00007DF449D25227
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D271FE	16_2_00007DF449D271FE
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D1C5C4	16_2_00007DF449D1C5C4
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D221C7	16_2_00007DF449D221C7
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_00007DF449D1A5A5	16_2_00007DF449D1A5A5
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782D3210	17_2_00000242782D3210
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782D2254	17_2_00000242782D2254
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782D2AA0	17_2_00000242782D2AA0
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C92D4	17_2_00000242782C92D4
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782D3B40	17_2_00000242782D3B40
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B737C	17_2_00000242782B737C
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C53C8	17_2_00000242782C53C8
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782BBC68	17_2_00000242782BBC68
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782DC500	17_2_00000242782DC500
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782CA4F8	17_2_00000242782CA4F8
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C9D30	17_2_00000242782C9D30
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B6D37	17_2_00000242782B6D37
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782CE51C	17_2_00000242782CE51C
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782D25B4	17_2_00000242782D25B4
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B8DF4	17_2_00000242782B8DF4
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782BC5D4	17_2_00000242782BC5D4
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782CAE10	17_2_00000242782CAE10
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782E1E08	17_2_00000242782E1E08
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782BD604	17_2_00000242782BD604
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782DC668	17_2_00000242782DC668
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782D4660	17_2_00000242782D4660
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C8EB8	17_2_00000242782C8EB8
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782CF76C	17_2_00000242782CF76C
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C27A4	17_2_00000242782C27A4
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782BBFE4	17_2_00000242782BBFE4
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C9818	17_2_00000242782C9818
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782CA860	17_2_00000242782CA860
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C8980	17_2_00000242782C8980
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782D4144	17_2_00000242782D4144
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782C9998	17_2_00000242782C9998

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 688

Source: TctqdRX5Wq.exe, 00000000.00000002.1716675170.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs TctqdRX5Wq.exe
Source: TctqdRX5Wq.exe, 00000000.00000002.1723676965.0000000003795000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs TctqdRX5Wq.exe

Source: TctqdRX5Wq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: TctqdRX5Wq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 12.2.OpenWith.exe.1c4b38bd970.1.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 12.3.OpenWith.exe.1c4b38bd970.4.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 12.3.OpenWith.exe.1c4b38bd970.5.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/9@0/1

Source: C:\Windows\System32\OpenWith.exe

Code function: 12_3_00007DF42F502634 CreateToolhelp32Snapshot,Thread32First,Thread32Next,CloseHandle,SuspendThread,

12_3_00007DF42F502634

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TctqdRX5Wq.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3744:120:WilError_03
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Mutant created: NULL
Source: C:\Windows\System32\SIHClient.exe	Mutant created: {376155FF-95A0-46CA-8F57-ACB09EA70153}
Source: C:\Windows\SysWOW64\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\53078613-99f7-4f67-aced-a6a5416f41e6

Jump to behavior

Source: TctqdRX5Wq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: TctqdRX5Wq.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Windows Media Player\setup_wm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Windows Media Player\setup_wm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: OpenWith.exe, 0000000C.00000003.2089693717.00007DF42F602000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088143901.000001C4B3725000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1837587060.000001C4B30DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1845688184.000001C4B30D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: OpenWith.exe, 0000000C.00000003.2089693717.00007DF42F602000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088143901.000001C4B3725000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1837587060.000001C4B30DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1845688184.000001C4B30D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OpenWith.exe, 0000000C.00000003.2089693717.00007DF42F602000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088143901.000001C4B3725000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1837587060.000001C4B30DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1845688184.000001C4B30D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: OpenWith.exe, 0000000C.00000003.2089693717.00007DF42F602000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088143901.000001C4B3725000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1837587060.000001C4B30DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1845688184.000001C4B30D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OpenWith.exe, 0000000C.00000003.2089693717.00007DF42F602000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088143901.000001C4B3725000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1837587060.000001C4B30DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1845688184.000001C4B30D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OpenWith.exe, 0000000C.00000003.2089693717.00007DF42F602000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088143901.000001C4B3725000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1837587060.000001C4B30DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1845688184.000001C4B30D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: OpenWith.exe, 0000000C.00000003.1870594160.000001C4B3BE5000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871378644.000001C4B3B7F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870818386.000001C4B3BE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OpenWith.exe, 0000000C.00000003.2089693717.00007DF42F602000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088143901.000001C4B3725000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1837587060.000001C4B30DA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1845688184.000001C4B30D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: TctqdRX5Wq.exe	ReversingLabs: Detection: 76%
Source: TctqdRX5Wq.exe	Virustotal: Detection: 72%

Source: unknown	Process created: C:\Users\user\Desktop\TctqdRX5Wq.exe "C:\Users\user\Desktop\TctqdRX5Wq.exe"
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 684
Source: C:\Windows\SysWOW64\OpenWith.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv gXqch/IrSkuvKvqIAnHVew.0.2
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\setup_wm.exe "C:\Program Files\Windows Media Player\setup_wm.exe"
Source: C:\Windows\SysWOW64\OpenWith.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\setup_wm.exe "C:\Program Files\Windows Media Player\setup_wm.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior

Source: C:\Windows\SysWOW64\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source: TctqdRX5Wq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: TctqdRX5Wq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: TctqdRX5Wq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdby^ source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: OpenWith.exe, 00000006.00000003.1737864385.0000000005300000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737759699.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb2j source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: OpenWith.exe, 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: OpenWith.exe, 00000006.00000003.1736083769.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1736374528.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: OpenWith.exe, 00000006.00000003.1737123646.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737430559.0000000005380000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: OpenWith.exe, 00000006.00000003.1736083769.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1736374528.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: OpenWith.exe, 00000006.00000003.1737123646.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737430559.0000000005380000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: OpenWith.exe, 00000006.00000003.1737864385.0000000005300000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1737759699.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: OpenWith.exe, 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 12.3.OpenWith.exe.1c4b38bd970.5.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.1c4b38bd970.5.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.2.OpenWith.exe.1c4b38bd970.1.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.2.OpenWith.exe.1c4b38bd970.1.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.1c4b38bd970.4.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.1c4b38bd970.4.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.2.OpenWith.exe.1c4b38b9d60.2.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.2.OpenWith.exe.1c4b38b9d60.2.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.1c4b38b9d60.6.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.1c4b38b9d60.6.raw.unpack, Runtime.cs	.Net Code: CoreMain

Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB3EE9 push ebx; iretd	6_3_02BB3EEA
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB2CE2 push es; retf	6_3_02BB2D11
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB2822 push ebp; iretd	6_3_02BB2823
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB4262 push eax; retf	6_3_02BB4271
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB21B0 pushad ; ret	6_3_02BB21B8
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB21F0 push ecx; iretd	6_3_02BB21FC
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB47F7 push esi; ret	6_3_02BB4802
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB0FD0 push eax; retf	6_3_02BB0FD1
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB2D15 push es; retf	6_3_02BB2D11
Source: C:\Windows\SysWOW64\OpenWith.exe	Code function: 6_3_02BB4B00 push edx; ret	6_3_02BB4B01
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_3_00000191683F1B00 push rax; iretd	16_3_00000191683F1B01
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B0BB9 pushad ; retf	17_2_00000242782B0BD6
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B061D push es; iretd	17_2_00000242782B062A
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B067C push 22A947ABh; retf	17_2_00000242782B0688
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B089C push es; ret	17_2_00000242782B089F
Source: C:\Windows\System32\dllhost.exe	Code function: 17_2_00000242782B0159 push FFFFFF8Dh; ret	17_2_00000242782B015F

Source: TctqdRX5Wq.exe

Static PE information: section name: .text entropy: 7.996682056923866

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\OpenWith.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\OpenWith.exe	API/Special instruction interceptor: Address: 54DA83A

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory allocated: D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory allocated: 4790000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Program Files\Windows Media Player\setup_wm.exe

Code function: 16_3_00000191683F73F0 sldt word ptr [rax]

16_3_00000191683F73F0

Source: C:\Windows\System32\dllhost.exe

Code function: GetAdaptersInfo,

17_2_00000242782B2AC4

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe TID: 6036	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\System32\SIHClient.exe TID: 6500	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Windows Media Player\setup_wm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Windows Media Player\setup_wm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\OpenWith.exe

Code function: 12_3_00007DF42F589F04 GetSystemInfo,

12_3_00007DF42F589F04

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: OpenWith.exe, 00000006.00000002.1800884339.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: qEMUjGZ
Source: OpenWith.exe, 0000000C.00000003.1870663279.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkmbolicLinkSymbolicLink
Source: OpenWith.exe, 0000000C.00000003.1870663279.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkLinkcLinkSymbolicLink
Source: OpenWith.exe, 00000006.00000002.1800473996.0000000003028000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs
Source: OpenWith.exe, 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: OpenWith.exe, 00000006.00000002.1800884339.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: :PVmCi~
Source: OpenWith.exe, 0000000C.00000003.1849761118.000001C4B36F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMCIDevSymbol
Source: OpenWith.exe, 00000006.00000002.1800473996.0000000003028000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OpenWith.exe, 0000000C.00000003.1848670499.000001C4B36C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLinkcLinkSymbolicLink
Source: OpenWith.exe, 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\OpenWith.exe

Code function: 6_3_02BB0283 mov eax, dword ptr fs:[00000030h]

6_3_02BB0283

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 242782B0000 protect: page read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe

Code function: 0_2_02792145 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02792145

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 462000	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 472000	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47B000	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47D000	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11C9008	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Memory written: C:\Windows\System32\dllhost.exe base: 242782B0000	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF70F3314E0	Jump to behavior

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\setup_wm.exe "C:\Program Files\Windows Media Player\setup_wm.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\TctqdRX5Wq.exe	Queries volume information: C:\Users\user\Desktop\TctqdRX5Wq.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Code function: 12_3_00007DF42F521B18 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

12_3_00007DF42F521B18

Source: C:\Windows\SysWOW64\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0.2.TctqdRX5Wq.exe.3795570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TctqdRX5Wq.exe.3795570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723676965.0000000003795000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1735196079.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1764339472.0000000004979000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1739918743.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1800884339.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: OpenWith.exe, 0000000C.00000003.1879887528.000001C4B36EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %\ElectrumSV
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\ElectronCash\config
Source: OpenWith.exe, 0000000C.00000003.1905734640.000001C4B36F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\com.liberty.jaxx
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: OpenWith.exe, 0000000C.00000003.2033593746.000001C4B36F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus
Source: OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets
Source: OpenWith.exe, 0000000C.00000002.2090027335.000001C4B1658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Lives

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\thumbnails	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing\google4	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior

Source: Yara match

File source: Process Memory Space: OpenWith.exe PID: 2872, type: MEMORYSTR

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0.2.TctqdRX5Wq.exe.3795570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TctqdRX5Wq.exe.3795570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723676965.0000000003795000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1735196079.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1764339472.0000000004979000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1739918743.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1800884339.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F521B18 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	12_3_00007DF42F521B18
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_00007DF42F554088 socket,bind,	12_3_00007DF42F554088
Source: C:\Program Files\Windows Media Player\setup_wm.exe	Code function: 16_2_000001916820CDF4 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	16_2_000001916820CDF4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	11 Masquerading	1 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Email Collection	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	21 Input Capture	71 Virtualization/Sandbox Evasion	Remote Desktop Protocol	21 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	71 Virtualization/Sandbox Evasion	1 Credentials in Registry	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	21 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	145 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TctqdRX5Wq.exe	76%	ReversingLabs	ByteCode-MSIL.Spyware.Rhadamanthys
TctqdRX5Wq.exe	72%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g	11%	Virustotal		Browse
https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g(	1%	Virustotal		Browse
https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0gkernelbasentdllkernel32GetProcessMitigation	1%	Virustotal		Browse
https://discord.com	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://discordapp.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g	true	11%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com	OpenWith.exe, 0000000C.00000003.1878159928.000001C4B3BEE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0g(	OpenWith.exe, 00000006.00000002.1800181660.0000000002BAC000.00000004.00000010.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://135.181.4.162:2423/97e9fc994198e76/ok9djscw.jxh0gkernelbasentdllkernel32GetProcessMitigation	OpenWith.exe, 00000006.00000002.1801414267.000000000562A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t.mc_id=EnterPK201694ba2e0b-6	OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870663279.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3B7B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mic)	OpenWith.exe, 0000000C.00000003.1878512690.000001C4B36F3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discordapp.com	OpenWith.exe, 0000000C.00000003.1878159928.000001C4B3BEE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	OpenWith.exe, 0000000C.00000003.1872339760.000001C4B3641000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871542217.000001C4B398A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3BA0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1899631638.000001C4B3BAA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1876331692.000001C4B362B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3B7B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	OpenWith.exe, 0000000C.00000003.1872339760.000001C4B3641000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871542217.000001C4B398A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872074569.000001C4B3BA0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1899631638.000001C4B3BAA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1876331692.000001C4B362B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mic	OpenWith.exe, 0000000C.00000003.2033593746.000001C4B36F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B36E2000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006573754.000001C4B36F8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1879533287.000001C4B36F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2088305060.000001C4B36F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B36EE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090897935.000001C4B36F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1906879801.000001C4B36F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B36EE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B36F3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	OpenWith.exe, 0000000C.00000003.1876882190.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1907147043.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873507016.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1872783770.000001C4B3663000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1870266082.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000002.2090682912.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905961871.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875754085.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2033352520.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1898999005.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873292564.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871887979.000001C4B366A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1875022702.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871033957.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1878512690.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1873976059.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1869733313.000001C4B366C000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1910899682.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1905222382.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1871650965.000001C4B3668000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.2006206125.000001C4B366D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://135.h	RegAsm.exe, 00000005.00000002.1739152797.000000000123C000.00000004.00000010.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
135.181.4.162	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526561
Start date and time:	2024-10-06 10:21:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TctqdRX5Wq.exe renamed because original name is a hash value
Original Sample Name:	04564c481b2b3c094bef173df90782f6fc83bd7a02c028024676ee1036d8fa1f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/9@0/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 62% Number of executed functions: 148 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 199.232.214.172, 13.95.31.18
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target OpenWith.exe, PID 2656 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:22:18	API Interceptor	2x Sleep call for process: SIHClient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
135.181.4.162	msvcp110.dll	Get hash	malicious	RHADAMANTHYS	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	https://reviewe-014035.firebaseapp.com/	Get hash	malicious	Phisher	Browse	199.232.210.172
	http://www.grandsignatureyercaud.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://daf2019.com/8/02	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://ofreverence.neocities.org/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://wtm.entree-plat-dessert.com/r/eNqtj01vgkAQhn8NvVXcL1gOplGBqgUraGrx0gC7iquAwqLVX99Ve2iT9ubMHN6ZyeSd56hbEBqA6oCbGCPCAQM0phBhC7IUJHBp4phQznVAEdGxSfQEotRYwjYyKWMGQTFoQwMCK4mxCmupt1U2+lPTyaTc1RrqatBVxVmLF7Li/HG3jeUj43XNK9lKy/yyRy7nGrJv32jQUHf2UdkpuVfSXC6C9bAo5mAqNzN3IcLBoB0KacxNSptTOZpGXmrlfX/q7OFn8n7yUEaceiRW/VPoRudGgwT2crMOCCGr4Xl86V1zIgp5juC1sfd2lCXe8KU7Pryth8GiG+RWUUQEilF2skVEzh6ejS3PwcBeGTPfB5zNXTo5YPHsrF+vDscJq+zellaxHwrkrW62I0kdAcp+Qvz5oCw3ySY+bGyF1sj8oy6bKr2wF9vvSc7ZusnVJOMx49UDSzt34P9N/4P9DuR/cP9H/QVY0sGG	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://blmphilly.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	Aquantia_Setup 2.21.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	INVOICE-COAU7230734290.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.214.172
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.214.172
	956d73b7f041.exe	Get hash	malicious	Stealc	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	updater.exe	Get hash	malicious	Xmrig	Browse	5.161.70.189
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	136.243.190.131
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	49.12.197.9
	https://s3.amazonaws.com/r3e1272/Rco.html#4eyOul3510eTKK19nejdimaazo189TBUDIERNFIMTFBQ264510CRSG907S11	Get hash	malicious	Phisher	Browse	5.161.250.225
	w4DO1Z18yg.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	https://indexconectada.net.br/	Get hash	malicious	Unknown	Browse	85.10.195.17
	https://iasitvlife.ro	Get hash	malicious	Unknown	Browse	49.12.228.110

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
caec7ddf6889590d999d7ca1b76373b6	g753nr4GI9.exe	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	msvcp110.dll	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	qsKo.ps1	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	DCF368HPtv.exe	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	ji2OQQH0ei.exe	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	zaD1vaze6V.ps1	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	1kfRGncRyD.exe	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	5qckfVuvzX.exe	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
	file.exe	Get hash	malicious	RHADAMANTHYS, XWorm	Browse	135.181.4.162
	QIkZ7aeVBV.msi	Get hash	malicious	DanaBot, RHADAMANTHYS	Browse	135.181.4.162

Process:	C:\Windows\System32\SIHClient.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4679554894199565
Encrypted:	false
SSDEEP:	6:kKBIElC8+l0iJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:hlCskPlE99SCQl2DUevat
MD5:	53B714B1EF4C49D7CE65F1570CC00BCC
SHA1:	C8B5B9B5974D8C0E9A631CD1F1C8935484932B6D
SHA-256:	A3F708108D589D80302C759697F3A8BD4C11095361D74FCA99D9CC3C84ADF2AB
SHA-512:	1BE3988DEE213E0AC6E79C565B49ACBA9CAE927CD5645F8147EAC2047934AD6BFC18FEB6FF7DD0F98D3B2755A0B932F34BCC94A4121F7CF9D30C33BE7105945E
Malicious:	false
Preview:	p...... ........~j_.....(................................................U.@... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TctqdRX5Wq.exe.log

Download File

Process:	C:\Users\user\Desktop\TctqdRX5Wq.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Windows\Logs\SIH\SIH.20241006.042216.173.1.etl

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.1518263183961412
Encrypted:	false
SSDEEP:	96:FZYIS+QQwvM+awWsrb7xYuY72U9IcNkZo8YcbIpSIlcGEGJLQwjk5ix:FZjQQyMzfo7Rwlaih87bk/5EG+Ck5ix
MD5:	9233AB735175B8A2C204CE527331366E
SHA1:	E9927EB8179D928FCCB1183FCB211FA48F9937BD
SHA-256:	93BA89435FD1CA09A112A59AE77B1EA6B148A6E3A602B326A7A50E6F749F0DBB
SHA-512:	99947E62DC8FF0442F8C7A942F52B31E784FF55109C64A656B461F4BFF562761C39D121B92D46884BAF7C9B4E331BD356B61D169F4B8EA4B9170925E7AC3D343
Malicious:	false
Preview:	....P...P.......................................P...!...........................$...x...;..n....................eJ........_.....Zb....... ......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................O..............\.............S.I.H._.t.r.a.c.e._.l.o.g...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.S.I.H.\.S.I.H...2.0.2.4.1.0.0.6...0.4.2.2.1.6...1.7.3...1...e.t.l.......P.P.$...x...;..n....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP3B3A.tmp

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	17126
Entropy (8bit):	7.3117215578334935
Encrypted:	false
SSDEEP:	192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
MD5:	1B6460EE0273E97C251F7A67F49ACDB4
SHA1:	4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
SHA-256:	3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
SHA-512:	3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
Malicious:	false
Preview:	MSCF............D................\|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM.........z.;......t.<.o..\|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A....H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 7826 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 53283, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	24490
Entropy (8bit):	7.629144636744632
Encrypted:	false
SSDEEP:	384:iarwQcY8StpA7IQ6GCq30XPSIleI7lzCuqvfiSIleIx:iartHA7PCFP66Tqvfi6c
MD5:	ACD24F781C0C8F48A0BD86A0E9F2A154
SHA1:	93B2F4FBF96D15BE0766181AFACDB9FD9DD1B323
SHA-256:	5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
SHA-512:	7B1D821CF1210947344FCF0F9C4927B42271669015DEA1C179B2BEAD9025941138C139C22C068CBD7219B853C80FA01A04E26790D8D76A38FB8BEBE20E0A2A4A
Malicious:	false
Preview:	MSCF............D...............#................A..........d........B..............environment.cab.x.\&..BCK.\.T...N.....;LB.JW.. .w!....$...U....."........ (.. E..........w...e.Jf.3gN.{...{V.M4.!.....hn. p(... .a...f..f..j.....Kh5..l.DB\}.=.0.>..X.....z..,'..LC/>....h.>.>.........,~mVI.....'EGD]^..\{....Q....f...4.F.....q..FF.1~...Q,.."g.qq.......}.....g%Zz.;m.9..z../2Jl.p8wGO......-V....FM......y.....Hy.xy......N.r;.@uV........Xa...b].`..F...y.Wd.e.8.[Z.s7].....=B.$...'.\|.-.sC....a_(..$..i.C.T.F}...]...m.R,y.1...'..j3.....ir..B..)sR.G...`-=.w....m..2y.....o...\{..C.4.:ZM..wL-$.I.x:?.!.....:..W.%&.....J.%.....~....E..T.d.Q{..p..J..pY...P../.."rp....`...#w.....'.\|n%Dy,.....i....."..x.....b._..\_.^.XOo..*:.&a.`..qA.?.@..t.R/...X3.nF.&........1Z.r.S...9x........?..aP..A...f..k:..\....L...t....Q...1..A..33A1.t..)...c....;......$.$..>._....A.!g`..t...b.H.L..&.....!......v~.n...uE.x...."5.h.4..B.R.d.4.%--.`.B..."..[....l......x(..5......@.zr....

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMPCDA8.tmp

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 858 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 12183, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	modified
Size (bytes):	19826
Entropy (8bit):	7.454351722487538
Encrypted:	false
SSDEEP:	384:3j+naF6zsHqnltHNsAR9zCfsOCUPTNbZR9zOzD8K:z1F6JLts89zIdrFT9zwoK
MD5:	455385A0D5098033A4C17F7B85593E6A
SHA1:	E94CC93C84E9A3A99CAD3C2BD01BFD8829A3BCD6
SHA-256:	2798430E34DF443265228B6F510FC0CFAC333100194289ED0488D1D62C5367A7
SHA-512:	104FA2DAD10520D46EB537786868515683752665757824068383DC4B9C03121B79D9F519D8842878DB02C9630D1DFE2BBC6E4D7B08AFC820E813C250B735621A
Malicious:	false
Preview:	MSCF....Z.......D................/..........Z....J..........d.......................environment.xml........CK....8.....w..=.9%T`.eu:.jn.E.8......m_.o?...5.K.{.3X3....^.{i..b......{.+.....y:..KW;;\..n.K=.]k..{.=..3......D$.&IQH.$-..8.r.{..HP.........g....^..~......e.f2^..N.`.B..o.t....z..3..[#..{S.m..w....<M...j..6.k.K.....~.SP.mx..;N.5..~\.[.!gP...9r@"82"%.B%..<2.c....vO..hB.Fi....{...;.}..f\|..g.7..6..].7B..O..#d..]Ls.k..Le...2...&I.Q.,....0.\.-.#..L%.Z.G..K.tU.n...J..TM....4....~...:..2.X..p.d....&.Bj.P(.."..).s.d....W.=n8...n...rr..O._.yu...R..$....[...=H"K<.`.e...d.1.3.gk....M..<R......%1BX.[......X.....q......:...3..w....QN7. .qF..A......Q.p...G...JtL...8sr.s.eQ.zD.u...s.....tjj.G.....Fo...f`Bb<.]k..e.b..,......1.:-....K.......M..;....(,.W.V(^_.....9.,`\|...9...>..R...2\|.\|5.r....n.y>wwU..5...0.J....H........J.0.I....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...>^..~a..e.D.V.C...

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 11149 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 18779, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	30005
Entropy (8bit):	7.7369400192915085
Encrypted:	false
SSDEEP:	768:ouCAyCeQ8fkZdfTGo/its89z8gjP69zA4:Aqf56z8HzT
MD5:	4D7FE667BCB647FE9F2DA6FC8B95BDAE
SHA1:	B4B20C75C9AC2AD00D131E387BCB839F6FAAABCA
SHA-256:	BE273EA75322249FBF58C9CAD3C8DA5A70811837EF9064733E4F5FF1969D4078
SHA-512:	DDB8569A5A5F9AD3CCB990B0A723B64CEE4D49FA6515A8E5C029C1B9E2801F59259A0FC401E27372C133952E4C4840521419EF75895260FA22DFF91E0BE09C02
Malicious:	false
Preview:	MSCF.....+......D...............[I...........+...I..........d.......rM..............environment.cab...Q.!+rMCK.\|.XT....CI7.....AR..$..C$D....RA:....T..........o...g...>.....s....z...>..<...J.R.A......%}..... 0............\...e.z...@..{..,./.:9:X8.s^q...>.(]...I)....'..v@....!.(.i.n.!.g.8\/.+X3.E.~.pi...Q...B...."Oj..~.:....M....uB.}..v.WR........tDD......D7..j..`..5..E.2.z..C....4.s....r..Y.:.\|.mtg...S..b._.....!.~Kn..E.=...x.N..e.)....xz...p..h.;..xR'...U.}........nK.+.Y........p..r _.;?.m}$..%&...8. 7..T....,7..F...e...kI.y...q....".W.W..[..gZQ.....W.$k.T"...N....5.R...,+...u.~VO...R-......H7..9........].K....]....tS~.LSi....T....3+........k......i.J.y...,.Y\|.N.t.LX.....zu..8......S7..{y.m.....Ob.....^.S8Kn.i.._.c~.x.ce.A...t........S.......i1......V..S]H....$..J....E..j...4...o.$..).....;.n<.b.}.(.J.]...Q..u,.-.Bm.[z.j..-i.."...._v.......N..+...g..v..../...;G.Yw....0..u...z....J..K.E..s&..u.h3.]J.G............Z....=.N.X..

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4361362956265733
Encrypted:	false
SSDEEP:	6:kKZb3C8lJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:pClkPlE99SCQl2DUevat
MD5:	628DDAF413B0A24186B5DE32FA281DD7
SHA1:	BD6A87F3945FE609674DCB68EEF59787607767EF
SHA-256:	B385C568508118C906015D45A4E83CF3DF553A8FD4C0019C8A9C43540E66B02B
SHA-512:	DE0C9CB0D9A29FAEC5D994D305A87EBA3E8AF102CCB575AE6026FFD772EFAC0EF9ED16FED4702D9FBDE82D937D139C8B0412E3730AFCC72B3E335C5DAAD818BD
Malicious:	false
Preview:	p...... ................(................................................".17... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\TctqdRX5Wq.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.991643512335788
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	TctqdRX5Wq.exe
File size:	449'536 bytes
MD5:	34ecbd07c675ebc57c044ec300621a2d
SHA1:	348846c91d64300811928ab1db473be7501fc921
SHA256:	04564c481b2b3c094bef173df90782f6fc83bd7a02c028024676ee1036d8fa1f
SHA512:	44fd498c7bf3ee71c6758890082b21a7b2bf5d29a2f516397a008c76bc0906fc4db7fa0188a40b1efc1e46d7ec468c6f289344f983aaa6c77d679cc5fe060c38
SSDEEP:	12288:k2PTQogMxqNImSpIY0VEs4lR1H+6YvTb7w9N9:tDdHSMH+6YLPw
TLSH:	9AA423135300AB0CF4A9AF38496B14AC027CE73A8A51679F39817DDE5B39F59137B8B1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-.f..................... ........... ........@.. ....................... ............`................................

File Icon


Icon Hash:	0f134db2b24d1317

Static PE Info

General

Entrypoint:	0x46d8ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F52DE2 [Thu Sep 26 09:48:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d894	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e000	0x1dc2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6d75c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6b8f4	0x6ba00	111be55b75020590681433e5f179dac0	False	0.9950752213995354	data	7.996682056923866	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6e000	0x1dc2	0x1e00	449f835707bb8fce147315344129b75d	False	0.8947916666666667	data	7.541038116424116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0xc	0x200	d43b500febd1730d43ee5b95f41885dd	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6e13c	0x1761	PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced	1.0018379281537175
RT_GROUP_ICON	0x6f8a0	0x14	data	1.2
RT_VERSION	0x6f8b4	0x324	data	0.4552238805970149
RT_MANIFEST	0x6fbd8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-06T10:22:07.778773+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	2423	192.168.2.4	49730	TCP
2024-10-06T10:22:19.187045+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	2423	192.168.2.4	49734	TCP
2024-10-06T10:22:19.187045+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	135.181.4.162	2423	192.168.2.4	49734	TCP
2024-10-06T10:22:29.593854+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	2423	192.168.2.4	49738	TCP
2024-10-06T10:22:29.593854+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	135.181.4.162	2423	192.168.2.4	49738	TCP
2024-10-06T10:22:35.593541+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49739	TCP
2024-10-06T10:22:42.152937+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49740	TCP
2024-10-06T10:22:48.742012+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49741	TCP
2024-10-06T10:22:55.352587+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49742	TCP
2024-10-06T10:23:01.928600+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49779	TCP
2024-10-06T10:23:08.529764+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49820	TCP
2024-10-06T10:23:15.108270+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49856	TCP
2024-10-06T10:23:21.683053+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49887	TCP
2024-10-06T10:23:28.262803+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49930	TCP
2024-10-06T10:23:34.884884+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	49973	TCP
2024-10-06T10:23:41.477069+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	50015	TCP
2024-10-06T10:23:48.947004+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	50016	TCP
2024-10-06T10:23:55.548051+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	50017	TCP
2024-10-06T10:24:02.112855+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	135.181.4.162	443	192.168.2.4	50018	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 10:22:07.109680891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:07.115034103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:07.115154028 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:07.115248919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:07.120057106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:07.772461891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:07.773441076 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:07.778773069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:07.976392031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:07.983659029 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:07.988672972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.195868969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.195928097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.195947886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.195965052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.195981979 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.195997953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.196017027 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.196053982 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.196249008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.196283102 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.196317911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.196485043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.196485043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.196485043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.203155994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.203222990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.203250885 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.203260899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.203505039 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.282445908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.282490015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.282700062 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.303755999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.303802967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.303841114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.303944111 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.307162046 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.307192087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.307259083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.307287931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.307324886 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.307324886 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.315448999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.315495968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.315536022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.315644979 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.315644979 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.322664022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.322710991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.322747946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.322860956 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.330034018 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.330073118 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.330106974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.330112934 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.330255985 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.340017080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.340051889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.340089083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.340209961 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.345206976 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.345241070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.345266104 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.345276117 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.345324993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.351845980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.351881981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.351916075 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.351943970 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.359220028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.359251022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.359280109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.359286070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.359330893 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.359420061 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.366458893 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.366492987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.366524935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.366544008 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.366583109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.390938044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.390986919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.391022921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.391041040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.391057014 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.391100883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.391211033 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.412022114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.412061930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.412098885 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.412102938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.412297964 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.415412903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.415446997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.415481091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.415499926 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.422971010 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.423013926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.423054934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.423094034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.423240900 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.423240900 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.429979086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.430017948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.430056095 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.430093050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.430094004 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.430159092 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.437001944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.437037945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.437061071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.437077045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.437130928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.444010973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.444046974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.444083929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.444129944 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.451325893 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.451359987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.451420069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.451452971 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.451493979 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.458304882 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.458336115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.458410025 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.461987972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.462023020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.462059975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.462110996 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.468980074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.469010115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.469119072 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.469182014 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.469211102 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.469362020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.476325989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.476361036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.476396084 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.476428986 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.476471901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.482326984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.482362032 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.482394934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.482423067 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.488054991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.488085985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.488126040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.488168955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.488203049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.488239050 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.493499994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.493534088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.493566990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.493596077 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.493637085 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.498692989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.498760939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.498791933 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.498819113 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.503827095 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.503861904 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.503895044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.503916025 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.503964901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.508805990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.508951902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.508981943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.509015083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.509022951 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.509073019 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.513926983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.513959885 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.513993979 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.514025927 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.518796921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.518831968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.518860102 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.518867016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.518925905 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.523842096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.523875952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.523926973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.523943901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.528770924 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.528805017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.528832912 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.528837919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.528888941 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.533638000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.533704042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.533767939 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.533768892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.533798933 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.533845901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.536735058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.536763906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.536798000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.536822081 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.536900043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.536951065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.539725065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.539760113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.539793015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.539813042 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.550470114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.550503969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.550533056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.550539970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.550574064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.550595045 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.550611019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.550659895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.551301003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.551335096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.551369905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.551389933 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.552665949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.552700043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.552726030 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.552732944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.552788973 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.556946993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.556982040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.557014942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.557049036 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.557749033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.557776928 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.557802916 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.557843924 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.557872057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.557898045 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.560956001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.560988903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.561022043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.561039925 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.561081886 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.563837051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.563870907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.563905001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.563925982 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.566904068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.566936970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.566970110 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.566982031 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.567027092 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.570425034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.570458889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.570489883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.570518017 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.572947025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.572979927 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.573012114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.573025942 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.573075056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.575869083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.575896978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.575952053 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.575963020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.575990915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.576045990 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.578923941 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.578955889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.578988075 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.579013109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.581931114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.581964970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.581996918 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.582040071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.582073927 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.584799051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.584862947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.584919930 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.584928036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.584955931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.585022926 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.587801933 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.587836027 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.587869883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.587889910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.590887070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.590920925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.590953112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.590959072 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.591010094 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.593662977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.593729973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.593759060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.593786001 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.593789101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.593841076 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.596796036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.596827984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.596858978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.596883059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.599570036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.599632978 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.599636078 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.599666119 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.599699974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.599721909 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.602471113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.602534056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.602535963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.602603912 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.602632046 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.602664948 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.605542898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.605576992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.605619907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.605633020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.605684042 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.608341932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.608375072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.608407021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.608443022 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.611305952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.611340046 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.611371994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.611371994 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.611423016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.614291906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.614320040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.614352942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.614372969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.614383936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.614437103 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.617019892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.617125034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.617165089 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.617177010 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.617305040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.619932890 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.619966030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.619998932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.620019913 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.622757912 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.622791052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.622823000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.622842073 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.622872114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.625416040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.625449896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.625482082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.625534058 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.628165960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.628199100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.628231049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.628267050 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.628314018 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.630892038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.630923986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.630955935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.630981922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.633480072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.633512974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.633543968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.633546114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.633598089 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.636006117 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.636038065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.636071920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.636107922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.638540983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.638622046 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.638632059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.638698101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.638725996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.638786077 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.641264915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.641298056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.641330004 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.641343117 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.641381979 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.643758059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.643791914 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.643822908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.643851042 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.646238089 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.646315098 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.646348000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.646377087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.646411896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.646437883 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.648821115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.648853064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.648885012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.648938894 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.648982048 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.650911093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.650939941 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.650975943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.651021004 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.651036978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.651094913 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.653124094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.653156042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.653188944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.653213978 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.655402899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.655431032 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.655467987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.655495882 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.655523062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.655556917 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.657078028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.657105923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.657145023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.657157898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.657186031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.657226086 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.659079075 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.659111977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.659146070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.659148932 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.659209013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.661194086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.661226988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.661258936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.661278963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.663269997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.663302898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.663335085 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.663336992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.663418055 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.664598942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.664628983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.664684057 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.664694071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.664721966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.664773941 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.666250944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.666378975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.666436911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.666444063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.666471958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.666522980 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.668122053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.668170929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.668203115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.668231010 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.669862986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.669895887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.669929028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.669948101 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.669977903 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.671511889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.671540022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.671598911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.671607971 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.671636105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.671685934 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.673295975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.673329115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.673361063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.673383951 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.674962997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.674994946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.675024033 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.675028086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.675091028 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.677222967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.677257061 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.677289009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.677304983 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.678239107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.678266048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.678316116 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.678343058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.678448915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.680078983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.680110931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.680144072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.680175066 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.680210114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.681497097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.681529999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.681562901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.681591034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.683028936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.683063030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.683095932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.683098078 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.683152914 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.684627056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.684658051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.684690952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.684717894 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.686139107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.686167002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.686202049 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.686232090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.686259985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.686301947 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.687661886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.687694073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.687726021 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.687726974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.687779903 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.689240932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.689273119 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.689305067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.689328909 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.690912962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.690944910 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.690978050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.690998077 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.691028118 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.692219973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.692286968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.692317963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.692341089 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.693695068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.693727016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.693754911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.693758965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.693811893 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.695172071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.695247889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.695307970 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.695323944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.695353031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.695429087 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.696607113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.696635008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.696692944 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.696700096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.696727991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.696779013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.697985888 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.698014021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.698045969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.698072910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.698107958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.698165894 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.699364901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.699414968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.699446917 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.699474096 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.700783968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.700815916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.700845957 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.700848103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.700901031 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.702105045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.702136993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.702169895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.702214003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.703866005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.703898907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.703931093 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.703932047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.703985929 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.706693888 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.706726074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.706758022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.706779003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.706877947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.706911087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.706939936 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.706943035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.706995010 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.712173939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712255955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712286949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712333918 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.712404013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712459087 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.712467909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712502003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712534904 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712555885 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.712568998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.712622881 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.717828035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.717890024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.717926025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.717951059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.717958927 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.717997074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.718017101 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.718024969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.718080044 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.725503922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725537062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725570917 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725604057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725615025 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.725639105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725657940 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.725752115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725784063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725805044 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.725816011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.725867987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.730611086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730643034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730676889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730714083 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.730747938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730811119 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.730811119 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730846882 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730879068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730901003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.730911016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.730982065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.737795115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.737827063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.737859964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.737896919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.737905979 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.737951994 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.737963915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.738073111 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.738110065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.738126993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.738142014 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.738194942 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.744026899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744060993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744095087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744117022 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.744129896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744184017 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.744368076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744492054 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744541883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744551897 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.744575024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.744622946 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.750096083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750130892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750164986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750199080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750209093 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.750252008 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.750277996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750343084 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750374079 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750395060 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.750406981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.750461102 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.754954100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.754981995 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.755032063 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.755044937 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.755110979 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.755145073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.755168915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.755177975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.755213022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.755235910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.755284071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.755342960 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.758397102 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758429050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758464098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758490086 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.758514881 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758569956 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.758574963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758636951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758671045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758692980 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.758703947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.758754969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.764077902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.764141083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.764177084 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.764198065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.764209986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.764245033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.764264107 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.764312029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.764345884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.764370918 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.768389940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768455029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768455982 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.768487930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768522024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768548965 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.768591881 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768625975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768646002 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.768659115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768692017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.768717051 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.772923946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.772952080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.772986889 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.773019075 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.773051977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.773081064 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.773088932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.773123026 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.773140907 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.773413897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.773472071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.773478031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.777744055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.777806044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.777820110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.777842045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.777874947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.777903080 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.777910948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.777944088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.777966022 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.777977943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.778031111 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.780611038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.780672073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.780705929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.780730009 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.780738115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.780772924 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.780791044 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.780806065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.780842066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.780860901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.784825087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.784888029 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.784892082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.784925938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.784959078 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.784996033 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.785109043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.785140991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.785171032 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.785177946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.785207987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.785240889 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.788918972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.788981915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.788984060 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.789016962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.789048910 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.789082050 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.789084911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.789118052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.789144039 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.789151907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.789210081 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.793492079 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793557882 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793590069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793621063 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.793622017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793678999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.793701887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793809891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793843031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793862104 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.793874025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.793943882 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.799732924 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.799761057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.799814939 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.799823999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.799858093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.799890041 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.799911976 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.799921989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.799957037 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.799976110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.799989939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.800040007 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.812248945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812314034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812371969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.812377930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812412977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812447071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812473059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.812479973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812532902 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.812833071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812896967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.812951088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.817446947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.817601919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.817636013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.817670107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.817692041 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.817703009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.817734957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.817737103 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.817785978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.817790985 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.824840069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.824903965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.824908018 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.824940920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.824979067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.825007915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.825012922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.825059891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.825062037 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.825139999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.825195074 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.836841106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.836869001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.836931944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.836957932 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.836994886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837029934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837061882 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.837064028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837099075 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837120056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.837130070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837169886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837182999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.837882996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837914944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837944984 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.837950945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.837980986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.838007927 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.838221073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.838253975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.838279963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.845418930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845484018 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845490932 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.845520020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845552921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845573902 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.845601082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845633984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845668077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845671892 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.845725060 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.845829964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845896959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845927954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.845954895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.845963001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.846014977 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.846226931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.846313000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.846344948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.846366882 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.846378088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.846431971 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.850745916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.850811005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.850842953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.850867987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.850954056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.850986958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.851011992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.851020098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.851052999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.851078987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.851087093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.851145029 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.855226994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855261087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855293989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855319023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.855328083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855377913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855379105 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.855456114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855504036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855513096 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.855556965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.855612040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.859961987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.859994888 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.860028982 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.860050917 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.860064030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.860115051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.860120058 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.860147953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.860182047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.860203981 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.860210896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.860269070 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.864557028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864587069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864640951 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.864650011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864684105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864715099 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864737034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.864748001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864779949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864801884 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.864811897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.864862919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.871726036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.871797085 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.871830940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.871884108 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.871896029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.871954918 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.871963024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.871998072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872051954 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.872062922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872096062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872148037 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.872160912 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872191906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872226954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872246981 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.872258902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872294903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872313976 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.872872114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.872927904 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.875696898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.875763893 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.875827074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.875843048 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.875858068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.875894070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.875925064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.875926971 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.875958920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.875989914 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.875992060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.876050949 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.886040926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886070013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886102915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886135101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886167049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886229992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886261940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886265993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.886265993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.886296988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886329889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886343956 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.886343956 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.886364937 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886399984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886439085 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.886934042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.886991024 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.887022972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.887058973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.887088060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.887115955 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.899311066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.899343967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.899422884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.899445057 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.899455070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.899488926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.899522066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.899555922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.899573088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.899573088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.899612904 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.904278040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904305935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904362917 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.904406071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904438972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904473066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904505014 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904505968 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.904540062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904556036 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.904573917 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.904632092 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.911694050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.911756992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.911791086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.911822081 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.911844969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.911855936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.911885023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.911890030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.911945105 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.912002087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.923695087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.923757076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.923790932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.923794031 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.923824072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.923846006 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.923930883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.923990965 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.923991919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924026966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924060106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924084902 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.924093008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924127102 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924149036 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.924160957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924196005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924216986 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.924578905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.924633026 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.924720049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932183027 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932245970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932255030 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.932312012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932344913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932378054 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932379007 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.932410955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932434082 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.932446003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932477951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932498932 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.932559967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932591915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932620049 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.932626963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932662010 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.932723045 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.933190107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.933257103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.933258057 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.937783003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.937815905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.937849998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.937855005 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.937884092 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.937912941 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.937922955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.937979937 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.938023090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.938055038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.938088894 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.938108921 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.942049980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942114115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942115068 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.942178011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942240000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942240953 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.942311049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942343950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942367077 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.942378044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942410946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.942434072 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.946779966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.946813107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.946844101 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.946846962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.946907997 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.946908951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.946975946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.947010040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.947036982 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.947045088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.947077036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.947102070 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.951445103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.951493025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.951527119 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.951527119 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.951576948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.951591969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.951617002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.951669931 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.951678991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.951714039 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.951766014 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.958585978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.958669901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.958700895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.958719015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.958734989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.958750963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.958766937 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.959014893 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.962383986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962449074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962457895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.962480068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962539911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.962591887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962652922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962686062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962707043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.962718964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962753057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.962771893 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.962982893 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.963038921 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.963047028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.963109970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.963144064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.963167906 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.963176966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.963213921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.963237047 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.963646889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.963707924 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.972805023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.972867966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.972902060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.972954988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.972965002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973011971 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.973031044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973093033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973125935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973140955 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.973157883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973193884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973202944 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.973227024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973261118 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973278999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.973293066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973329067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973344088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.973361969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.973409891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.986102104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986139059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986213923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986239910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.986246109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986279964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986299038 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.986311913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986346960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986362934 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.986380100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.986427069 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.991220951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.991254091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.991287947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.991307020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.991322041 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.991358042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.991373062 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.991416931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.991462946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.991477013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:08.998953104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999001026 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999017954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999032974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999049902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999064922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999082088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999098063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:08.999203920 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.011218071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011250973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011286020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011303902 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.011338949 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.011352062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011399984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011439085 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011457920 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.011471987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011507988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011528969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.011540890 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011595011 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.011735916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011799097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011832952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011850119 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.011867046 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011898994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.011913061 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.018979073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019042015 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.019045115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019079924 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019114971 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019134998 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.019221067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019274950 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.019324064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019359112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019407034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019432068 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.019440889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019474983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019498110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.019509077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019542933 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.019557953 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.020060062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.020095110 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.020117998 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.028945923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029041052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029056072 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.029136896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029169083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029194117 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.029202938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029234886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029258013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.029270887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029299974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.029329062 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.033554077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033620119 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033633947 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.033653021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033685923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033708096 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.033828974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033862114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033879995 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.033898115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033925056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.033941984 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.038199902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038263083 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.038271904 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038348913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038403988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038405895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.038438082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038491964 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.038502932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038537025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038592100 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.038600922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038633108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038666964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038683891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.038701057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038733959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038752079 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.038769007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038804054 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.038817883 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.045423985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.045490980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.045510054 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.045541048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.045574903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.045597076 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.045607090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.045650005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.045661926 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.045691013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.045744896 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.049299002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049364090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049396992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049421072 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.049431086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049484968 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.049540043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049571037 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049607038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049619913 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.049635887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.049681902 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.059613943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.059725046 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.059819937 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.059824944 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.059854984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.059890032 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.059911013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.059954882 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.059987068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060010910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.060090065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060141087 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.060153008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060189009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060241938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.060267925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060302973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060334921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060353041 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.060369015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060404062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060422897 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.060784101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060837030 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.060880899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060945034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.060977936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.061000109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.061009884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.061044931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.061068058 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.072925091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.072958946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.073015928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.073024988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.073080063 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.073090076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.073123932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.073156118 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.073174000 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.073189974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.073239088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.073261023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078020096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078071117 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078083992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.078111887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078164101 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.078186989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078222036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078254938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078278065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.078289032 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.078346014 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.085607052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.085669994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.085702896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.085725069 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.085768938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.085808039 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.085824013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.085843086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.085876942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.085889101 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.098335028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098385096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098418951 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.098419905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098455906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098481894 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.098510981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098562002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098571062 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.098596096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098629951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098653078 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.098664045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098695993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098718882 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.098730087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098762035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098783016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.098795891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098830938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.098845005 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.105998993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106034040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106070042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106079102 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.106112003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106127024 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.106163979 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106197119 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106223106 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.106249094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106298923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106307983 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.106333971 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106367111 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106389046 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.106400967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106434107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106455088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.106472969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.106519938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.107136011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116045952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116096020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116103888 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.116131067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116163969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116183043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.116199017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116230965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116250992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.116265059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.116321087 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.120580912 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.120632887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.120666027 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.120688915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.120697021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.120733023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.120759010 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.120785952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.120820999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.120847940 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.125000000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125061989 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.125077009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125133038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125185966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125219107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125219107 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.125253916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125272036 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.125308990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125344038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125365019 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.125376940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125412941 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125437975 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.125895023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125927925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125952959 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.125962019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.125993967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.126012087 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.126025915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.126077890 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.132375956 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132420063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132472038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132504940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132514000 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.132539034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132560968 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.132571936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132606030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132622957 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.132638931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.132687092 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.136379957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.136414051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.136468887 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.136482954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.136516094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.136549950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.136569977 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.136581898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.136616945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.136631012 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.146337986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146368027 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146399021 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.146419048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146454096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146470070 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.146486998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146522045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146531105 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.146555901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146589041 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.146617889 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.147002935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147036076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147056103 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.147068977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147124052 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.147217989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147253990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147294998 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.147303104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147403002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147439957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147444963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.147473097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147516966 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.147846937 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147895098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147929907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147939920 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.147963047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.147995949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.148008108 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.148027897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.148071051 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.159816027 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.159867048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.159899950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.159930944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.159934044 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.159965992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.159981966 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.160001993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.160053968 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.160605907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172341108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172398090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172414064 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.172431946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172477007 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.172482014 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172518015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172549009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172569990 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.172585011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172617912 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172635078 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.172671080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172703028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172724962 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.172736883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172772884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.172787905 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.173358917 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.173432112 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.173433065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185154915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185183048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185199022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185214996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185233116 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185261011 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.185261011 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.185312986 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.185336113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185353041 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185400009 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.185609102 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185625076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185647964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185663939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185667038 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.185682058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185697079 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185708046 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.185713053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.185736895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.192903042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.192969084 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.193031073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193046093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193062067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193077087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193092108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193110943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193135023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193154097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193171024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193182945 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.193182945 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.193182945 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.193187952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.193201065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.193238020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.193989038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.194005966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.194021940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.194035053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.194051981 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.194092035 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.203058958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203083992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203100920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203119040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203141928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.203164101 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.203304052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203321934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203340054 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203353882 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.203365088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.203413010 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.207379103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207458019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207514048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207541943 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.207566977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207602978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207623959 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.207638025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207672119 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207690001 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.207706928 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.207756042 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.211982012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212110043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212146044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212177992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.212178946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212229967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212234974 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.212265015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212300062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212321997 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.212367058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212400913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212424040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.212452888 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212486029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212510109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.212521076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212554932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212572098 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.212589979 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.212644100 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.219423056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219456911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219491005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219523907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219537020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.219559908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219571114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.219597101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219630003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219650984 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.219660997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.219715118 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.223267078 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.223376036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.223443031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.223442078 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.223476887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.223510981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.223535061 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.223546028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.223579884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.223597050 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.235786915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.235820055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.235853910 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.235884905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.235935926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.235968113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236001968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236035109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236088991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236124992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236157894 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236150980 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.236192942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236226082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236234903 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.236234903 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.236234903 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.236236095 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.236258984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.236275911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.246907949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.246994019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247045994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247067928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.247080088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247134924 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.247139931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247190952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247189999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.247227907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247260094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247282982 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.247293949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247328043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247358084 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.247363091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247414112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247431993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.247448921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247484922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.247509003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.259268045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.259320021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.259352922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.259367943 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.259402990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.259435892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.259469986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.259505033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.259526014 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.259526014 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.259553909 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.272315025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272367954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272389889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272406101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272422075 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272437096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272454023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272484064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272502899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.272536993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.272692919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.273370981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273421049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273453951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273485899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273518085 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273530006 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.273550987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273576975 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.273606062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273639917 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273659945 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.273673058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273710966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273730040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.273763895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273792982 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.273814917 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.280483961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280535936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280554056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.280570030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280601025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280617952 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.280635118 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280668020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280680895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.280702114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280750036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280767918 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.280783892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.280833006 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.280991077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.281028986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.281063080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.281074047 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.281095028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.281128883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.281141043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.290178061 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.290235043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.290241003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.290286064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.290318966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.290334940 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.290352106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.290384054 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.290400028 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.290417910 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.290466070 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.294329882 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294364929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294414997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294434071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.294449091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294498920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294498920 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.294532061 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294564962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294576883 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.294598103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.294641972 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.298661947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.298691034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.298737049 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.298784971 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.298851013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.298882961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.298902988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.298917055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.298969984 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.299140930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299288034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299339056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.299402952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299436092 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299469948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299484015 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.299501896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299535990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299554110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.299570084 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.299613953 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.299942017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306392908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306444883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306472063 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.306478977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306513071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306524992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.306545019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306580067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306593895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.306662083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.306711912 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.310067892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310128927 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310175896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310194016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.310209990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310242891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310271978 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.310296059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310328007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310350895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.310360909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.310411930 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.322551012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322609901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322642088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322674990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322707891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322706938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.322802067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322834969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322885990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322900057 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.322900057 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.322918892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322953939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.322959900 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.322987080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.323019981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.323024035 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.323055029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.323086977 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.323685884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.323743105 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.333787918 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.333822966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.333856106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.333888054 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.333915949 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.333925962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.333949089 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.333976030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334024906 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.334026098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334060907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334105968 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.334110975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334144115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334177017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334189892 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.334208965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334242105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334256887 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.334275961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.334321022 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.359011889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359071016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359102964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359137058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359162092 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.359172106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359205961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359231949 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.359281063 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.359334946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359400034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359451056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359462023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.359483957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359517097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359544039 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.359549046 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359582901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.359611988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.360096931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360146999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360152006 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.360181093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360213041 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360229969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.360245943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360277891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360295057 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.360312939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360344887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360358000 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.360820055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360882998 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.360897064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360945940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.360980034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.361002922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.361011028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.361046076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.361068010 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.361459017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.361545086 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.366946936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.366976976 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367029905 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.367075920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367126942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367161989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367182016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.367192984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367227077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367254019 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.367259026 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367292881 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367326021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367326021 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.367378950 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.367789984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367841005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367873907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367897987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.367907047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367939949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.367957115 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.376912117 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.376946926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.376980066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.377002001 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.377015114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.377032042 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.377048969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.377082109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.377110004 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.377115965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.377146006 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.377171993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.381278992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381313086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381335974 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.381346941 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381398916 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.381400108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381439924 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381472111 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381480932 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.381509066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381536961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.381555080 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.385812044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.385862112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.385867119 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.385895967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.385946989 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.385947943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.385981083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.386013031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.386023998 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.386048079 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.386091948 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.393183947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.393218040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.393250942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.393275023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.393305063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.393338919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.393368959 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.393371105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.393405914 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.393419981 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.396819115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.396869898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.396879911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.396920919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.396954060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.396970987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.396986008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397018909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397030115 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.397053003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397114038 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.397170067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397399902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397449970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397449970 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.397484064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397516966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397530079 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.397550106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397593975 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.397677898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397897959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.397942066 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.409548044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409581900 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409627914 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.409631968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409682989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409715891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409734011 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.409765005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409799099 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409816980 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.409832001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409866095 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409882069 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.409898996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409931898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409950018 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.409964085 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.409997940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.410008907 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.410558939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.410605907 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.420675993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.420706034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.420754910 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.420762062 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.420789957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.420821905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.420839071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.420855045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.420887947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.420898914 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.421164989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421199083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421221972 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.421231985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421267033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421279907 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.421541929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421575069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421591997 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.421624899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421652079 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.421664953 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.445959091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446012974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446017981 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446052074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446099043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446103096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446155071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446187019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446202040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446219921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446265936 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446269035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446304083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446335077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446347952 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446372032 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446419001 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446629047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446679115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446712017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446722984 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446744919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446778059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446789980 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.446810007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446842909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.446855068 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.447288036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.447319984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.447335958 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.447355032 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.447381973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.447416067 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.453691959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.453746080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.453752041 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.453795910 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.453830004 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.453847885 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.453864098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.453908920 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.453947067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.453979015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454010963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454020023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.454039097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454081059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.454232931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454272032 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454313993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.454322100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454356909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454389095 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454401016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.454421997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454466105 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.454673052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454724073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454768896 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.454773903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454808950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454840899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.454850912 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.455148935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.455195904 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.455276012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.463710070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.463740110 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.463768005 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.463788986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.463824987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.463841915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.463856936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.463891983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.463901043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.464062929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.464114904 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.464165926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468137980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468170881 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468204021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468218088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.468238115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468262911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.468271017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468306065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468312025 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.468338966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468369961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.468380928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.472507954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472541094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472560883 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.472590923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472640038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472640991 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.472676039 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472707987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472723961 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.472740889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472774029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.472790003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.479954004 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.479988098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.480020046 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.480037928 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.480087996 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.480087996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.480123043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.480154037 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.480171919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.480189085 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.480216026 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.480231047 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.483721972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.483771086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.483778954 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.483822107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.483853102 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.483870983 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.483886957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.483918905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.483935118 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.483954906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.483987093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.484002113 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.484074116 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.484107971 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.484124899 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.484142065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.484174967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.484189034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.484208107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.484251022 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.484535933 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496582985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496635914 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496645927 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.496665955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496716976 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496718884 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.496750116 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496795893 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.496799946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496834040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496867895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496882915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.496900082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496932983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.496947050 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.496968031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.497014999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.497332096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.497364998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.497411013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.497415066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.497442961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.497484922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.507504940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507539034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507571936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507591963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.507606983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507642031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507659912 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.507674932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507709980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507728100 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.507741928 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507775068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.507795095 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.508059978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.508111000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.508120060 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.508145094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.508177042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.508198977 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.508214951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.508409023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.508445024 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.532818079 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.532843113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.532859087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.532875061 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.532891035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.532998085 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533010960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533026934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533052921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533066988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533091068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533102036 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533112049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533123016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533128977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533144951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533160925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533164024 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533190966 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533806086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533823013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533838987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533858061 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533890009 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533905029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533919096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533934116 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533950090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.533961058 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.533989906 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.540503025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540523052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540549040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540564060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540582895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540602922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540626049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540623903 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.540646076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540664911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.540676117 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.540699005 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.541160107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541188002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541207075 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541224003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541240931 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.541243076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541261911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541274071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.541304111 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.541686058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541702986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541721106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541745901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.541748047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541763067 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.541764975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541785002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541809082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.541825056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.541857004 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.554900885 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.554917097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.554951906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.554965973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.554982901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.554994106 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.554997921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555026054 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.555044889 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.555058002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555073977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555088997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555104017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555114031 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.555120945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555136919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.555835962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555852890 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555870056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555882931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.555893898 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.555915117 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.559406996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.559431076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.559447050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.559462070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.559463978 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.559478045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.559489965 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.559518099 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.559572935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.559588909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.559638977 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.566975117 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567043066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567080021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567114115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567138910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.567150116 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567183018 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567203999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.567223072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567233086 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.567253113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.567305088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.572004080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.572040081 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.572076082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.572096109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.572108030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.572155952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.572177887 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.572189093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.572223902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.572243929 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.583220005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583271980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583323002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583350897 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.583353996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583439112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583472967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583509922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583509922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.583509922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.583548069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583563089 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.583652973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583682060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583703995 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.583731890 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583765030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583781958 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.583797932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.583846092 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.584048986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584101915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584151983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584153891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.584184885 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584218979 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584249973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584259987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.584283113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584295034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.584316969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584351063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.584367037 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.594470024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.594520092 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.594537020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.594552994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.594585896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.594607115 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.594619989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.594652891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.594680071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.594685078 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.594738960 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.619564056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.619873047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.619901896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.619935036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.619961977 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.619968891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620002985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620053053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620085955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620119095 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620150089 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620152950 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.620152950 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.620152950 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.620183945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620198011 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.620486021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620517969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620553017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620567083 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.620582104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620628119 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.620733023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620783091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620816946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620830059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.620848894 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620883942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.620884895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.621076107 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.621141911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.621176004 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.622709990 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.627284050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627315044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627363920 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.627365112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627441883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627491951 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.627491951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627526999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627563953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627578020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.627594948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627629995 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627645016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.627661943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627696037 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.627711058 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.628118992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628174067 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.628174067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628226995 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628258944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628278017 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.628292084 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628324986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628343105 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.628356934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628391981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628412008 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.628892899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628926992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.628947020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.628978968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.629012108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.629039049 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.629046917 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.629081011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.629100084 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.629129887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.629162073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.629179955 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.629203081 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.629251957 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.641838074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.641868114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.641918898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.641959906 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.641969919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642003059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642019987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.642035961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642071009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642097950 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.642102003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642137051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642168999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642193079 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.642205954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642258883 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.642724991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642756939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642790079 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.642791033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642821074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.642865896 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.646193981 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646224022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646253109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.646274090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646323919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646357059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646373034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.646389961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646425009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646435976 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.646456957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.646482944 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.653733015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.653894901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.653923988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.653955936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.653990030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.653990030 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.654021978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.654026985 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.654047012 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.654056072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.654089928 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.654098988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.698328018 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.878470898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878542900 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878577948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878611088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878644943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878645897 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.878678083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878681898 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.878715992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878726959 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.878750086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878784895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878802061 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.878817081 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878865004 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.878880024 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878945112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.878979921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879010916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879029036 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879045010 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879057884 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879079103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879112959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879122972 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879147053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879180908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879213095 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879220009 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879246950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879278898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879287958 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879313946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879317999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879345894 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879379988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879401922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879446983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879483938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879525900 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879564047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879617929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879661083 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879678011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879712105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879717112 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879745007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879777908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879787922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879827976 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879862070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879873037 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879894972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879928112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879956007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.879976034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.879997969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880012989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880045891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880060911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880079985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880112886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880145073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880157948 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880178928 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880211115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880225897 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880244017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880255938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880290031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880322933 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880336046 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880356073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880388021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880398989 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880420923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880435944 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880455017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880486012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880501032 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880518913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880552053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880564928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880585909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880618095 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880650043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880665064 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880681992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880686045 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880717039 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880744934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880762100 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880811930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880861998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880908012 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.880909920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880943060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880976915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.880986929 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881011009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881026030 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881043911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881078005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881091118 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881110907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881144047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881160975 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881176949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881210089 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881241083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881256104 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881274939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881306887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881321907 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881341934 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881361008 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881377935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881421089 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881452084 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881470919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881488085 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881489038 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881685019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881731987 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881788969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881823063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881855965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.881865978 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.881891012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.882487059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.886681080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886749029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886784077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886837959 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.886846066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886882067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886892080 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.886915922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886949062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886962891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.886962891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.886981010 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.886986017 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887017012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887049913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887073040 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887084007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887095928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887120008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887166023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887499094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887547970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887582064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887614012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887629032 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887646914 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887679100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887692928 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887713909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887721062 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887747049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887779951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887792110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.887816906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.887861967 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.888410091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888462067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888511896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888544083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888561964 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.888577938 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888609886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888643026 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.888643980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888657093 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.888680935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888715029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888724089 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.888748884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.888792038 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.889309883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889359951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889393091 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889441013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889441967 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.889473915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889507055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889518023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.889539957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889547110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.889573097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889606953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889627934 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.889642000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.889688969 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.890280962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890333891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890383005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890414953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890429020 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.890448093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890480042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890491962 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.890513897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890523911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.890547037 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890579939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890611887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.890626907 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.890701056 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.891258001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891290903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891340971 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891371965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891418934 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.891439915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891444921 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.891473055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891505957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891519070 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.891539097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891571999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891604900 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.891616106 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.891776085 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.892066956 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892236948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892287016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892291069 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.892322063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892354012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892388105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892399073 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.892420053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892455101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892466068 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.892488003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892497063 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.892524004 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.892530918 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.892577887 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.892586946 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.893033028 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893107891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893143892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893163919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.893193960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893227100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893259048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893275023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.893291950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893306971 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.893325090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893357992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893373966 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.893392086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893964052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.893997908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894016027 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.894150019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894200087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894201994 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.894248962 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.894252062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894284964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894318104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894335032 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.894350052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894382954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894423962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894433022 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.894459009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894493103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.894509077 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.894542933 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.895179033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895231962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895281076 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.895282984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895315886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895349026 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895380020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895401955 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.895428896 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.895428896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895478964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895513058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895545006 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.895558119 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.895641088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.896033049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896049023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896074057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896087885 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896091938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.896104097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896127939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896130085 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.896146059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896161079 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896173000 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.896178007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896194935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896204948 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.896240950 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.896923065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896946907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896961927 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896976948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.896992922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897006989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897008896 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897023916 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897025108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897053003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897089958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897104025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897119045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897135019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897147894 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897150040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897165060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897169113 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897181034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897192955 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897233963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897847891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897862911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897877932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897902966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897903919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897918940 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897933960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897948980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.897962093 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.897989988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.898051023 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898066998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898082972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898098946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898102045 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.898113966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898117065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.898132086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898147106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898163080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898164034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.898180008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898186922 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.898224115 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.898827076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898842096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898857117 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898920059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.898972034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898986101 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.898999929 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899015903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899027109 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899039984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899041891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899055958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899071932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899077892 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899086952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899102926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899131060 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899151087 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899416924 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899466038 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899481058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899503946 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899507999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899548054 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899661064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899676085 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899691105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899705887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899720907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899733067 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899736881 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899753094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899754047 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899769068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899780035 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899784088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899800062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899806976 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899816036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899830103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899840117 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899846077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899862051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.899877071 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.899899960 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.900471926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900502920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900525093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900541067 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900554895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900567055 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.900569916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900579929 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.900588036 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900609016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.900619030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900633097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900648117 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900661945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900675058 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.900676966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900693893 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900702953 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.900708914 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.900716066 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.900748968 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930030107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930080891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930105925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930119991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930151939 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930166960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930185080 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930197954 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930217981 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930223942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930239916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930263996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930270910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930279970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930295944 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930310965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930310965 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930325985 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930341959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930346012 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930366039 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930366993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930382967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930396080 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930408955 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930413961 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930429935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930452108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930460930 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930468082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930473089 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930483103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930497885 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930511951 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930527925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930527925 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930542946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930551052 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930560112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930572033 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930576086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930592060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930603981 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930608034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930624962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930636883 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930639982 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930660009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930665970 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930675983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930691957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930701971 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930706978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930722952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930738926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930747986 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930753946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930766106 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930769920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930787086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930794001 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.930802107 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.930830002 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.931586027 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.931648970 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.966968060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967027903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967067003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967096090 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967099905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967119932 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967134953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967166901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967217922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967219114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967252970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967286110 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967298985 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967325926 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967336893 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967370033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967410088 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967422962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967473030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967519999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967523098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967556953 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967605114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967638016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967653990 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967673063 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967705011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967717886 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967737913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967750072 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967771053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967803001 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967816114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967835903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967881918 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.967885017 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967917919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967951059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967983007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.967995882 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968015909 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968049049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968061924 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968085051 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968091965 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968117952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968153000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968163013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968183994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968220949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968228102 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968255043 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968286991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968317986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968332052 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968350887 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968383074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968401909 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968415022 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968425989 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.968450069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.968501091 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.974778891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.974891901 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.974920988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.974951982 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.974972010 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975023031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975063086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975070953 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975112915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975146055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975169897 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975178957 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975183964 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975228071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975279093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975292921 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975327015 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975359917 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975373983 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975411892 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975444078 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975491047 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975506067 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975523949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975555897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975569963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975594044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975605011 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975626945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975660086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975677967 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975692987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975725889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975742102 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975758076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975790977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975822926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975836992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975855112 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975887060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975904942 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:09.975920916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:09.975936890 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.016627073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016680956 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016714096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016748905 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.016765118 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016782999 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.016820908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016865015 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.016872883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016925097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016957045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.016971111 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.016989946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017019033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017034054 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017071009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017107964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017155886 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017157078 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017206907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017251968 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017256021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017290115 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017301083 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017353058 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017390966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017399073 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017422915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017456055 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017467976 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017488956 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017524004 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017555952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017569065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017589092 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017620087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017633915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017652035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017662048 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017684937 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017719030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017731905 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017750025 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017781973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017796993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017812967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017844915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017875910 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017889977 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017911911 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017944098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017959118 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.017978907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.017988920 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.018011093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018044949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018054962 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.018099070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018132925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018163919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018179893 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.018198013 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018230915 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018244028 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.018265963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.018275023 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.035698891 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.053761005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.053797960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.053834915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.053839922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.053873062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.053908110 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.053924084 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.053941011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.053947926 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.053994894 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054048061 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054064035 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054099083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054131031 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054147959 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054164886 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054197073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054229975 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054245949 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054275036 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054277897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054311991 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054344893 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054361105 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054378033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054461002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054495096 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054508924 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054527044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054544926 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054560900 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054609060 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054641962 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054655075 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054691076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054723978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054737091 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054755926 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054769039 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054788113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054821014 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054833889 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054853916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054886103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054902077 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.054927111 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054959059 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.054991007 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055006027 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.055022955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055037975 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.055062056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055097103 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055115938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.055130959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055166006 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055180073 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.055200100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055232048 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055265903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.055279016 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.055622101 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.061687946 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.061741114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.061791897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.061824083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.061858892 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.061858892 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.061873913 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.061907053 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.061939955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.061966896 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.061990976 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062033892 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062041044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062093019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062125921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062148094 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062194109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062247992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062266111 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062297106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062330008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062352896 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062361956 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062397003 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062427998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062443018 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062463045 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062485933 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062494040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062527895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062561989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062562943 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062594891 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062624931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062639952 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062658072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062663078 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062691927 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062726021 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062736034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.062757969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062791109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062824011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.062838078 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.063493013 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.066407919 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.103537083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103595018 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103646994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103648901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.103697062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103734016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103786945 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103787899 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.103822947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103842974 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.103852034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103904009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103945971 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.103954077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.103987932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104007959 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104038000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104070902 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104104042 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104135990 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104140043 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104162931 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104187012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104229927 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104243040 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104274988 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104306936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104350090 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104355097 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104388952 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104403973 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104422092 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104453087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104470015 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104485035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104516029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104547977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104572058 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104578972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104603052 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104613066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104645967 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104660988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104679108 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104711056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104726076 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104743958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104777098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104805946 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104809999 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104844093 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104877949 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104890108 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104908943 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104942083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.104958057 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.104973078 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.105005980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.105027914 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.105036974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.105048895 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.105074883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.105107069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.105130911 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.105143070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.105185986 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.105205059 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.105235100 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.140563965 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.140600920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.140633106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.140683889 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.140732050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.140765905 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.140799046 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.140814066 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.140846014 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.140948057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.140980959 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141014099 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141030073 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141066074 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141099930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141132116 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141148090 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141179085 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141182899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141216993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141251087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141264915 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141283035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141329050 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141333103 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141386986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141446114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141494989 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141496897 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141544104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141576052 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141591072 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141611099 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141622066 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141647100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141680002 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141693115 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141711950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141743898 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141757965 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141779900 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141814947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141845942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141859055 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141879082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141911030 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141927004 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.141946077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141977072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.141990900 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.142009974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.142023087 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.142043114 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.142077923 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.142098904 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.142110109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.142143011 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.142174006 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.142185926 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.142235994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.142265081 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.148611069 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148663998 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148715019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148725033 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.148761034 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.148765087 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148817062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148849964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148864031 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.148883104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148931980 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148981094 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.148983002 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149013996 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149060011 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149065018 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149112940 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149116993 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149149895 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149183035 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149195910 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149214983 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149246931 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149260998 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149280071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149312973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149344921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149358988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149375916 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149410009 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149421930 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149437904 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149456024 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149468899 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149502039 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149516106 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149533033 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149565935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149596930 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149610996 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149630070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149663925 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.149677992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.149705887 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.190829039 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.190891027 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.190939903 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.190972090 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.190987110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191004992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191020012 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191062927 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191112995 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191159964 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191164970 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191231966 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191282988 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191287041 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191319942 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191334963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191353083 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191410065 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191433907 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191484928 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191531897 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191570997 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191574097 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191621065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191663027 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191673994 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191706896 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191720963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191755056 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191787958 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191802979 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191821098 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191849947 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191864967 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191880941 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191912889 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191945076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191960096 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.191977978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.191987991 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192011118 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192043066 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192061901 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192076921 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192110062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192121029 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192142963 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192176104 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192188978 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192205906 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192236900 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192249060 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192271948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192305088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192336082 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192348957 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192368984 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192399979 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192411900 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192434072 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192441940 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192466974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192498922 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192512035 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.192531109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192563057 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.192575932 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234314919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234353065 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234369993 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234406948 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234452963 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234457016 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234492064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234524012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234539986 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234558105 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234589100 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234608889 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234622955 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234672070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234704971 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234719992 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234736919 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234769106 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234782934 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234802008 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234811068 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234853029 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234888077 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234898090 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234921932 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234952927 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.234971046 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.234987020 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235022068 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235030890 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235059977 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235094070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235107899 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235126972 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235158920 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235193968 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235209942 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235240936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235274076 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235284090 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235306978 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235316038 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235358000 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235399961 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235423088 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235461950 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235502005 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235503912 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235552073 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235584974 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235615969 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235618114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235649109 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235658884 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235682964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235726118 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235733986 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235769987 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235801935 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235815048 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235833883 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235866070 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235897064 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235908985 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235929012 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235960960 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.235979080 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.235992908 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236004114 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236026049 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236059904 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236071110 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236093044 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236124992 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236143112 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236159086 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236191034 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236223936 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236238003 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236255884 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236288071 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236305952 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236320019 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236335039 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236354113 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236386061 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236403942 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236422062 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236454964 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:10.236470938 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.236505032 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.253144979 CEST	49730	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:10.258090973 CEST	2423	49730	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:18.506606102 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:18.511529922 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:18.511621952 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:18.511780977 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:18.516566038 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.175200939 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.175230026 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.175318956 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:19.182254076 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:19.187045097 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.385984898 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.386198044 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:19.391071081 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.587138891 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.589658976 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:19.594542027 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.594600916 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:19.599467993 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.944272995 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.947359085 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:19.952419996 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:19.952483892 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:19.957408905 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.305461884 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.305500031 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.308208942 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.454210043 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.454325914 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.454391956 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.457496881 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.459211111 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459374905 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459419966 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459451914 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459454060 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.459505081 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.459599018 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459625959 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459659100 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.459692001 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.459701061 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459728956 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459774971 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.459775925 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.459780931 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.459837914 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.462584019 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.462611914 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.462693930 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.462748051 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.462774992 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.462841034 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.464375973 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.464457035 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.464519978 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.464582920 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.464898109 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.464977026 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.464977980 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.465008974 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.465095043 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.465253115 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.465280056 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.465351105 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.468122005 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.468213081 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.468239069 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.468245983 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.468316078 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.468316078 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.470808029 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.470834970 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.470897913 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.470949888 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:20.471667051 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.471754074 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.471807957 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.471890926 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.472666025 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.472811937 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.474144936 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.474172115 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.474199057 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.474225044 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.474251032 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.474276066 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.475984097 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.476011038 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.476038933 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.476063967 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.476089001 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.476114988 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.476139069 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.477962017 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.478009939 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.478041887 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.478146076 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.478214979 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.478240967 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.479038954 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.479064941 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.479094982 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.479141951 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.479825974 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:20.982698917 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.026449919 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:21.222949982 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:21.222950935 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:21.223069906 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:21.223108053 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:21.223176003 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:21.223228931 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:21.227875948 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.227925062 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.227972984 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.227998972 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228055000 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228101969 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228147030 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228173018 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228226900 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228276014 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228302956 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228327990 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228370905 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228396893 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228441954 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228467941 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228492975 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228518009 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.228544950 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.532509089 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:21.573472977 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:22.227238894 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:22.227240086 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:22.227240086 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:22.227356911 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:22.232311010 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232348919 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232431889 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232459068 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232492924 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:22.232516050 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232542992 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232573986 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232599974 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232625961 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232670069 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.232696056 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.236988068 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.237015009 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.237493992 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.541302919 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:22.604669094 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:23.542387962 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:23.547544956 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:23.547823906 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:23.552768946 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:23.893366098 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:23.893639088 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:23.893661022 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:23.893661022 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:23.893970966 CEST	49734	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:23.898705006 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:23.898804903 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:23.898835897 CEST	2423	49734	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:28.886182070 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:28.891283035 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:28.891479969 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:28.891513109 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:28.896410942 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:29.580995083 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:29.581046104 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:29.581229925 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:29.588918924 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:29.593853951 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:29.798511028 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:29.798748016 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:29.804542065 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.005948067 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.008407116 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.013608932 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.013680935 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.018657923 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.364721060 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.367072105 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.371948957 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.372001886 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.376785040 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.721868038 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.724956036 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.725012064 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.725053072 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.725085020 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.725120068 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.725132942 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.725162029 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.725303888 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.732542992 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.732589006 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.732624054 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.732626915 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.732667923 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.740123987 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.740221024 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.740257978 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.740457058 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.747598886 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.747641087 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.747674942 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.747678041 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.747731924 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.817289114 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.817383051 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.817468882 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.832905054 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.833048105 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.833079100 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.833112001 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.833115101 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.833158970 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.836576939 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.836611032 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.836642981 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.836663008 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.844326019 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.844400883 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.844418049 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.844432116 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.844598055 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.851814985 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.851847887 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.851878881 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.851897955 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.859520912 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.859600067 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.859626055 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.859632015 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.859671116 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.867113113 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.867146015 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.867178917 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.867199898 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.874530077 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.874631882 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.874649048 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.874806881 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.881711960 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.881743908 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.881776094 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.881788015 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.888721943 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.888817072 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.888818026 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.888845921 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.888878107 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.888889074 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.895997047 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.896029949 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.896048069 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.896061897 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.896102905 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.902822971 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.902911901 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.902954102 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.925221920 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.925255060 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.925292015 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.925308943 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.925326109 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.925442934 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.928864002 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.928895950 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.928920984 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.928927898 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.928960085 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.928973913 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.941045046 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.941076040 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.941092968 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.941240072 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.943818092 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.943845034 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.943876028 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.943886042 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.943908930 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.943950891 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.949160099 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.949208021 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.949243069 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.949263096 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.954071045 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.954104900 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.954113960 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.954138041 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.954174042 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.958947897 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.958980083 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.959011078 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.959024906 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.963841915 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.963874102 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.963901997 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.963905096 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.963947058 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.968828917 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.968858004 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.968902111 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.968907118 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.968934059 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.968976021 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.973617077 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.973643064 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.973774910 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.976100922 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.976150036 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.976181030 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.976201057 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.981378078 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.981426001 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.981439114 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.981458902 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.981504917 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.981519938 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.986361027 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.986388922 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.986419916 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.986432076 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.986452103 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.986469030 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.991435051 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.991466999 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.991491079 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.991497993 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.991547108 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:30.995748043 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.995779037 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.995809078 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:30.995829105 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.004468918 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.004502058 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.004535913 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.004537106 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.004578114 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.005506992 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.005538940 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.005570889 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.005582094 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.010364056 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.010396957 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.010420084 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.010427952 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.010473967 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.015410900 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.015443087 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.015472889 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.015480042 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.020215034 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.020246029 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.020262003 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.020277023 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.020317078 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.025222063 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.025253057 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.025283098 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.025295973 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.029853106 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.029884100 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.029916048 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.029918909 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.029953003 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.034316063 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.034348011 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.034378052 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.034388065 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.038862944 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.038893938 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.038909912 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.038924932 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.038968086 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.043287992 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.043318033 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.043348074 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.043359995 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.047435045 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.047466040 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.047483921 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.047497034 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.047537088 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.051668882 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.051700115 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.051729918 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.051739931 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.055917025 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.055948973 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.055967093 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.055979967 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.056021929 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.060129881 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.060161114 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.060190916 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.060204029 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.062849998 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.062880993 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.062896967 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.062912941 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.062952042 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.065344095 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.065371037 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.065411091 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.065418959 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.065444946 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.065481901 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.067964077 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.067991018 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.068031073 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.068039894 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.068067074 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.068109035 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.070535898 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.070565939 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.070596933 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.070606947 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.073184967 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.073215961 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.073234081 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.073246956 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.073291063 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:31.078342915 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:31.120165110 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.235598087 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.240734100 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.240796089 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.245805979 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.595969915 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.596012115 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.596052885 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.596065044 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.596098900 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.596134901 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.597978115 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.598011017 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.598045111 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.598047018 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.598077059 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.598112106 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.599452019 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.599483967 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.599517107 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.599519014 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.602685928 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.602729082 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.604208946 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.604243040 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.604269981 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.604281902 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.604302883 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.604337931 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.607521057 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.607601881 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.607640982 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.608983994 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.609016895 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.609047890 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.609055042 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.609078884 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.609113932 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.612457037 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.612488985 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.612524033 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.613750935 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.613782883 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.613811970 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.613843918 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.613869905 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.613920927 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.617324114 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.617383003 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.618555069 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.618587971 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.618613958 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.618622065 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.618645906 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.618676901 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.618680000 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.622217894 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.622250080 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.622265100 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.623298883 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.623330116 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.623343945 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.623358011 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.623394966 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.623404026 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.623437881 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.623464108 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.623476982 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.627108097 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.627144098 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.627154112 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.628057957 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.628089905 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.628101110 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.628118038 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.628146887 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.628156900 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.628309011 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.628349066 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.631934881 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.632008076 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.632045984 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.632802963 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.632834911 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.632862091 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.632875919 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.633127928 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.633160114 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.633172989 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.636889935 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.636923075 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.636931896 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.637583017 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.637614965 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.637626886 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.637643099 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.637671947 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.637676954 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.637990952 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.638032913 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.641700029 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.641731024 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.641771078 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.642646074 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.642678022 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.642707109 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.642719030 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.642883062 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.642918110 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.646668911 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.647459984 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.647491932 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.647504091 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.647522926 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.647559881 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.647778034 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.652203083 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.652235031 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.652249098 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.653667927 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.653752089 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.656950951 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.656984091 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.657015085 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.657021999 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.658569098 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.658601046 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.658612967 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.661750078 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.661781073 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.661791086 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.661808968 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.661844015 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.663328886 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.663360119 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.663395882 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.666563988 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.666598082 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.666629076 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.666632891 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.668076038 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.668107986 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.668239117 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.671302080 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.671334028 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.671355963 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.672821045 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.672854900 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.672873020 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.672885895 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.672924042 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.676054001 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.676086903 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.676127911 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.677655935 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.677689075 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.677725077 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.680793047 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.680824995 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.680867910 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.682423115 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.682471037 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.682502031 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.682512045 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.686249971 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.686281919 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.686300039 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.687520981 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.687551975 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.687577963 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.691804886 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.691838026 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.691874981 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.693424940 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.693456888 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.693476915 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.693486929 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.693521976 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.697499037 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.697530985 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.697566032 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.698800087 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.698832989 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.698874950 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.703054905 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.703088045 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.703128099 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.703567982 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.703599930 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.703731060 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.708698034 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.708729982 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.708760977 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.708786011 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.709146976 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.709180117 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.709191084 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.713470936 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.713505030 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.713524103 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.713903904 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.713936090 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.713943958 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.713963985 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.713999987 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.718916893 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.718950033 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.718981028 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.718991041 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.719027042 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.719059944 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.719060898 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.723890066 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.723942995 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.723949909 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.723970890 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.724009991 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.724020958 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.724052906 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.724087954 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.728720903 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.728770018 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.728801012 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.728821039 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.728835106 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.728866100 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.728871107 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.733453035 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.733489037 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.733525038 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.733536959 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.733568907 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.733572960 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.738230944 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.738280058 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.738296032 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.738312006 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.738344908 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.738348961 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.738375902 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.738413095 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.743046999 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.743094921 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.743125916 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.743155003 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.743158102 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.743201017 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.747837067 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.747870922 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.747903109 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.747924089 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.747934103 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.747965097 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.747971058 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.752700090 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.752732992 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.752764940 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.752768040 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.752796888 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.752810001 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.757493973 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.757544041 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.757559061 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.757575989 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.757607937 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.757617950 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.762240887 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.762290001 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.762296915 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.762320995 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.762351990 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.762365103 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.762383938 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.762418032 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.767079115 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.767127037 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.767158031 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.767170906 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.767189026 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.767229080 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.771974087 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.772006035 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.772037029 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.772068977 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.772100925 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.772245884 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.772245884 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.776729107 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.776777029 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.776786089 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.776808977 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.776839972 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.776845932 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.781519890 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.781552076 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.781568050 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.781584024 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.781615973 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.781627893 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.781646013 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.781682014 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.786289930 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.786322117 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.786353111 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.786364079 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.786384106 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.786422968 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.791418076 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.791450024 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.791481018 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.791493893 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.791529894 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.791563034 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.791570902 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.838927031 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.928880930 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.934233904 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:33.934287071 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:33.939378023 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:34.284739017 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:34.284800053 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:34.284832001 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:34.284965038 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:34.284965038 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:34.285007954 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:34.285049915 CEST	49738	2423	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:34.290235043 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:34.290262938 CEST	2423	49738	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:34.917531013 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:34.917622089 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:34.917815924 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:34.917896032 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:34.917916059 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:35.589179039 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:35.589279890 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:35.593486071 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:35.593540907 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:35.593846083 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:35.595330954 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:35.639442921 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:40.493995905 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:40.494067907 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:40.494210005 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:40.494294882 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:40.494294882 CEST	49739	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:40.494338989 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:40.494364977 CEST	443	49739	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:41.479990959 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:41.480030060 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:41.480258942 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:41.480295897 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:41.480305910 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:42.149576902 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:42.149859905 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:42.152926922 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:42.152936935 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:42.153143883 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:42.153980970 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:42.199408054 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:47.058554888 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:47.058634043 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:47.058690071 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:47.066684961 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:47.066684961 CEST	49740	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:47.066709995 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:47.066720963 CEST	443	49740	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:48.058109045 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:48.058243036 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:48.058644056 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:48.058644056 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:48.058779001 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:48.733920097 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:48.734044075 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:48.741977930 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:48.742012024 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:48.742356062 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:48.743434906 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:48.787488937 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:53.640224934 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:53.640352964 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:53.640729904 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:53.640731096 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:53.647310972 CEST	49741	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:53.647375107 CEST	443	49741	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:54.652026892 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:54.652126074 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:54.652271032 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:54.652586937 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:54.652611017 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:55.342084885 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:55.342274904 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:55.352535963 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:55.352586985 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:55.353147984 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:22:55.358409882 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:22:55.399451017 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:00.245683908 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:00.245775938 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:00.245942116 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:00.246021032 CEST	49742	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:00.246062994 CEST	443	49742	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:01.245568037 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:01.245595932 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:01.245765924 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:01.245887041 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:01.245904922 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:01.925138950 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:01.925538063 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:01.928580046 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:01.928600073 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:01.929107904 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:01.929965019 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:01.975408077 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:06.829580069 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:06.829664946 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:06.829786062 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:06.829866886 CEST	49779	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:06.829879999 CEST	443	49779	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:07.839195013 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:07.839215040 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:07.839297056 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:07.839375019 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:07.839405060 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:08.526081085 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:08.526154041 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:08.529751062 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:08.529763937 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:08.530092955 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:08.530776978 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:08.575448036 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:13.430742025 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:13.430815935 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:13.430938959 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:13.431018114 CEST	49820	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:13.431060076 CEST	443	49820	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:14.432934046 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:14.433006048 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:14.433155060 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:14.433239937 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:14.433253050 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:15.104492903 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:15.104623079 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:15.108234882 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:15.108269930 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:15.108481884 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:15.109175920 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:15.151467085 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:20.009505987 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:20.009556055 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:20.009677887 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:20.009706020 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:20.009715080 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:20.009753942 CEST	49856	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:20.009758949 CEST	443	49856	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:20.995434046 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:20.995506048 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:20.995599985 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:20.995682955 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:20.995697021 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:21.671618938 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:21.671705008 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:21.683042049 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:21.683053017 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:21.683410883 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:21.684173107 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:21.731410027 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:26.578541040 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:26.578627110 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:26.578728914 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:26.578787088 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:26.578787088 CEST	49887	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:26.578821898 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:26.578844070 CEST	443	49887	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:27.589355946 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:27.589437962 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:27.589517117 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:27.589581013 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:27.589615107 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:28.259135962 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:28.259355068 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:28.262790918 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:28.262803078 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:28.263012886 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:28.263663054 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:28.307435989 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:33.167110920 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:33.167201996 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:33.167355061 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:33.167356014 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:33.169173956 CEST	49930	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:33.169203043 CEST	443	49930	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:34.182924986 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:34.183006048 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:34.183276892 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:34.183276892 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:34.183352947 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:34.881287098 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:34.881427050 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:34.884854078 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:34.884884119 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:34.885214090 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:34.886014938 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:34.927423954 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:39.782725096 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:39.782793999 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:39.782860994 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:39.782861948 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:39.782941103 CEST	49973	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:39.782978058 CEST	443	49973	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:40.776693106 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:40.776789904 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:40.776865959 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:40.776926994 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:40.776945114 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:41.473365068 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:41.473618031 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:41.477041960 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:41.477068901 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:41.477490902 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:41.478167057 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:41.519406080 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:46.370846987 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:46.371014118 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:46.371205091 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:46.371205091 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:46.371205091 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:46.682782888 CEST	50015	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:46.682845116 CEST	443	50015	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:47.402582884 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:47.402672052 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:47.402981997 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:47.402982950 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:47.403110981 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:48.943321943 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:48.943417072 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:48.946974039 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:48.947004080 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:48.948103905 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:48.949090958 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:48.991447926 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:53.843724966 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:53.843895912 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:53.844091892 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:53.844345093 CEST	50016	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:53.844389915 CEST	443	50016	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:54.854852915 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:54.854974985 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:54.855070114 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:54.855158091 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:54.855179071 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:55.543917894 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:55.544038057 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:55.547997952 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:55.548051119 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:55.548928976 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:23:55.549649954 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:23:55.591450930 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:00.443563938 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:00.443738937 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:00.443813086 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:00.443875074 CEST	50017	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:00.443907976 CEST	443	50017	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:01.433238029 CEST	50018	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:01.433348894 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:01.433444023 CEST	50018	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:01.433540106 CEST	50018	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:01.433558941 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:02.108566046 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:02.108689070 CEST	50018	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:02.112837076 CEST	50018	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:02.112854958 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:02.113590956 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:02.114279032 CEST	50018	443	192.168.2.4	135.181.4.162
Oct 6, 2024 10:24:02.155513048 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:07.012335062 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:07.012487888 CEST	443	50018	135.181.4.162	192.168.2.4
Oct 6, 2024 10:24:07.012556076 CEST	50018	443	192.168.2.4	135.181.4.162

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 10:22:17.957602024 CEST	1.1.1.1	192.168.2.4	0xdbbd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 6, 2024 10:22:17.957602024 CEST	1.1.1.1	192.168.2.4	0xdbbd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:22:00
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\TctqdRX5Wq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TctqdRX5Wq.exe"
Imagebase:	0x3e0000
File size:	449'536 bytes
MD5 hash:	34ECBD07C675EBC57C044EC300621A2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000002.1723676965.0000000003795000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:22:00
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:22:01
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x3f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:22:01
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x400000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:22:01
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x2b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:22:01
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000005.00000002.1739918743.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:22:03
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\OpenWith.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0xb50000
File size:	107'368 bytes
MD5 hash:	0ED31792A7FFF811883F80047CBCFC91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000006.00000003.1735196079.0000000003010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000003.1738036427.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000006.00000003.1764339472.0000000004979000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000003.1738258496.0000000005400000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000006.00000002.1800884339.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:22:03
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 688
Imagebase:	0x8b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:22:03
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 684
Imagebase:	0x8b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:22:09
Start date:	06/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff7d0b80000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.2089235322.000001C4B3A71000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1847168318.000001C4B3924000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1846690752.000001C4B3871000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:22:16
Start date:	06/10/2024
Path:	C:\Windows\System32\SIHClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihclient.exe /cv gXqch/IrSkuvKvqIAnHVew.0.2
Imagebase:	0x7ff6d73f0000
File size:	380'720 bytes
MD5 hash:	8BE47315BF30475EEECE8E39599E9273
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:22:30
Start date:	06/10/2024
Path:	C:\Program Files\Windows Media Player\setup_wm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\setup_wm.exe"
Imagebase:	0x7ff7f8ab0000
File size:	1'857'024 bytes
MD5 hash:	F32C225D11A5AF5906CF7C15FDA955E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	04:22:33
Start date:	06/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	38.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	36.4%
Total number of Nodes:	22
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02792145 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,027920B7,027920A7), ref: 027922B4
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 027922C7
Wow64GetThreadContext.KERNEL32(00000344,00000000), ref: 027922E5
ReadProcessMemory.KERNELBASE(00000340,?,027920FB,00000004,00000000), ref: 02792309
VirtualAllocEx.KERNELBASE(00000340,?,?,00003000,00000040), ref: 02792334
TerminateProcess.KERNELBASE(00000340,00000000), ref: 02792353
WriteProcessMemory.KERNELBASE(00000340,00000000,?,?,00000000,?), ref: 0279238C
WriteProcessMemory.KERNELBASE(00000340,00400000,?,?,00000000,?,00000028), ref: 027923D7
WriteProcessMemory.KERNELBASE(00000340,?,?,00000004,00000000), ref: 02792415
Wow64SetThreadContext.KERNEL32(00000344,02750000), ref: 02792451
ResumeThread.KERNELBASE(00000344), ref: 02792460

Strings

VirtualAllocEx, xrefs: 02792245
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 027922B3
ReadProcessMemory, xrefs: 02792232
VirtualAlloc, xrefs: 0279220C
aryA, xrefs: 0279218B
WriteProcessMemory, xrefs: 02792258
ress, xrefs: 027921CF
SetThreadContext, xrefs: 0279226B
CreateProcessA, xrefs: 027921F9
GetThreadContext, xrefs: 0279221F
Load, xrefs: 02792183
GetP, xrefs: 027921C7
TerminateProcess, xrefs: 02792343
ResumeThread, xrefs: 02792281

Memory Dump Source

Source File: 00000000.00000002.1717126427.0000000002791000.00000040.00000800.00020000.00000000.sdmp, Offset: 02791000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2791000_TctqdRX5Wq.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 18e048021de1fc35df7ec7b149abecebd53b6783a1a5b062d23369eafab2ae87
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 8CB1E57664024AAFDB60CF68CC80BDA77A5FF88714F158124EA0CAB342D774FA518B94

Function 00D71268 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00D712F0

Memory Dump Source

Source File: 00000000.00000002.1716929261.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_TctqdRX5Wq.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a50e73842e6a5d7a21e553e8aa846b6cc8808fdf12af36ac059e6de4532923d2
Instruction ID: f2d9e5ba4db6d8ee285e7d11ccaa98fdf4bce62d24ee0be16557b1f71e0b5585
Opcode Fuzzy Hash: a50e73842e6a5d7a21e553e8aa846b6cc8808fdf12af36ac059e6de4532923d2
Instruction Fuzzy Hash: D82173B5900249DFDB10DFAAC880ADEBFF4FF49310F10842AE958A7211C734A904CFA6

Function 00D71270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00D712F0

Memory Dump Source

Source File: 00000000.00000002.1716929261.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_TctqdRX5Wq.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 986ec47f141fdb1b5c9e60146df54d7171e554ce9222b2ad8c0b44a641bbb5c2
Instruction ID: d1eeaea1e227d66602fb468152c35ba116a16d8b4018a5be02169d6528a0a88f
Opcode Fuzzy Hash: 986ec47f141fdb1b5c9e60146df54d7171e554ce9222b2ad8c0b44a641bbb5c2
Instruction Fuzzy Hash: BB2122B5900259DFCB10DFAAC880ADEFBF4FF48310F50842AE959A7250C774A944CFA5

Analysis Process: OpenWith.exePID: 2656, Parent PID: 1744COMMON

Executed Functions

Function 02BB02D8 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 169memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 02BB0326

Part of subcall function 02BB00A4: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02BB00CD
Part of subcall function 02BB00A4: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02BB0279

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 02BB0378
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 02BB03E7
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02BB0407
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 02BB042E
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02BB0456
CloseHandle.KERNELBASE(?), ref: 02BB0471

Strings

,, xrefs: 02BB0356

Memory Dump Source

Source File: 00000006.00000003.1735340063.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2bb0000_OpenWith.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 34919759cab89c45596a3336aca0d90db3a2564f30e7825e5c793611e7351f71
Instruction ID: 54c1dabaf21b0d2dd63bbe4b819905f74830dfff40c6b8b8fec69db98ac1221b
Opcode Fuzzy Hash: 34919759cab89c45596a3336aca0d90db3a2564f30e7825e5c793611e7351f71
Instruction Fuzzy Hash: 5F61FAB5900209EFDB21EFA5C984AEEBBB9FF08354F14C959E959A7240D770E940CF60

Function 02BB00A4 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02BB00CD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02BB0279

Memory Dump Source

Source File: 00000006.00000003.1735340063.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2bb0000_OpenWith.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: ffe7ede89c2bb6bc7bf7292240c592eaca0265a6ce3022c03cbee64a18376a2a
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: F3719971E0424ADFDB42DF98C881BFEBBF0AF09314F244495E4A1FB241C274AA95CB64

Non-executed Functions

Function 02BB0283 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1735340063.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2bb0000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 269b1f145bcdecbc01a0447229277282a1e753ddfc4086081446da2234d0da40
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 2DF0A979E012009F8B26EF09C5489F6B7B6EF80724B2449E5D404AB261D3F0ED8CCB60

Analysis Process: OpenWith.exePID: 2872, Parent PID: 1744COMMON

Execution Graph

Execution Coverage:	34.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	71.4%
Total number of Nodes:	28
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007DF42F52B498 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 544nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52B56E
calloc.MSVCRT ref: 00007DF42F52B58B
DuplicateHandle.KERNELBASE ref: 00007DF42F52B620
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B6CB
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B724
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B763
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B7AA
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B7E7
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B86D
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B8CC
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B9B2
NtAcceptConnectPort.NTDLL ref: 00007DF42F52B9EC
NtAcceptConnectPort.NTDLL ref: 00007DF42F52BA19

Strings

H, xrefs: 00007DF42F52B934
,, xrefs: 00007DF42F52B59E
H, xrefs: 00007DF42F52B94F

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$DuplicateHandlecalloc
String ID: ,$H$H
API String ID: 2577638757-438696205
Opcode ID: 9fb62eb4d8959293fc2d40b19de36242d3d29fe68d1ba52932dcd9bec1ad6912
Instruction ID: 18799ddda254d989482d5fb9ede898c95537d3b250fee2dbc79d72836da04370
Opcode Fuzzy Hash: 9fb62eb4d8959293fc2d40b19de36242d3d29fe68d1ba52932dcd9bec1ad6912
Instruction Fuzzy Hash: 6002793161CEC89BE764DF68D88566AB7E1FF98310F50463ED58FC3291DA34E5818B82

Function 00007DF42F52BCC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52BD8F
NtAcceptConnectPort.NTDLL ref: 00007DF42F52BE50
free.MSVCRT ref: 00007DF42F52BE55

Strings

, xrefs: 00007DF42F52BD7F
@, xrefs: 00007DF42F52BD48
0, xrefs: 00007DF42F52BD32

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$free
String ID: $0$@
API String ID: 2328307678-2347541974
Opcode ID: d8fdb236a247b9205c502de8d0d979f89367b2180e7993cbf521bb03780d7e1e
Instruction ID: 19b82b06ed84ace2642921b629400de0a470f33a14e6cbde5e1a8472aab1a848
Opcode Fuzzy Hash: d8fdb236a247b9205c502de8d0d979f89367b2180e7993cbf521bb03780d7e1e
Instruction Fuzzy Hash: A4516030628B849FE764DF68D8857AA77E0FF89310F50462EE58EC6241DF74A4C58B83

Function 00007DF42F52BE6C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 158nativeCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF42F52BE8D
NtAcceptConnectPort.NTDLL ref: 00007DF42F52BF3A

Strings

@, xrefs: 00007DF42F52BEEE
, xrefs: 00007DF42F52BF2A
0, xrefs: 00007DF42F52BED8

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPortcalloc
String ID: $0$@
API String ID: 2195583734-2347541974
Opcode ID: e038bc6975502a75aa15522c9d2aad796b46013016ac9629b0cf3dc02c1d6b17
Instruction ID: bdf9abd5d016202cb66d320b420cc5fa05f9cddbb496377badb816d4c3e6027f
Opcode Fuzzy Hash: e038bc6975502a75aa15522c9d2aad796b46013016ac9629b0cf3dc02c1d6b17
Instruction Fuzzy Hash: FF512C7060CB898FE764DB688858B9BB7E4EF94311F50462EE48AC2251EF75D5848B42

Function 000001C4B30030C7 Relevance: 7.9, APIs: 5, Instructions: 390nativememoryCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001C4B3003957
NtAcceptConnectPort.NTDLL ref: 000001C4B30039E4
NtAcceptConnectPort.NTDLL ref: 000001C4B3003AA3
RtlFreeHeap.NTDLL ref: 000001C4B3003AC0
RtlFreeHeap.NTDLL ref: 000001C4B3003AD2

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$FreeHeap
String ID:
API String ID: 2519882481-0
Opcode ID: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction ID: 8ea1d1da2c36ada25993290ab7f1a89253b2cf93e28bd31add6c97b14802f148
Opcode Fuzzy Hash: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction Fuzzy Hash: C4C1933025CB098FEB59EF29C495BA9B7E1FF98714F00456DE88AC7246DF30E8458B85

Function 00007DF42F521B18 Relevance: 4.6, APIs: 3, Instructions: 110pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNELBASE ref: 00007DF42F521BCF
BindIoCompletionCallback.KERNEL32 ref: 00007DF42F521C06
ConnectNamedPipe.KERNELBASE ref: 00007DF42F521C17

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: NamedPipe$BindCallbackCompletionConnectCreate
String ID:
API String ID: 2502124517-0
Opcode ID: 584620923d8bee05c4cd2b55fbc688861300e251001a2660cae9de72a1f183dd
Instruction ID: 96dce94e5b7b71e6c2140baabaf19ed68604c2834ec3ae825b9d86dd0324da4a
Opcode Fuzzy Hash: 584620923d8bee05c4cd2b55fbc688861300e251001a2660cae9de72a1f183dd
Instruction Fuzzy Hash: A2316D70608A888FE794EF68D89879B77E1FB94320F50463AD09BC6191DF78D8858B81

Function 00007DF42F52C7CC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF42F52C82B

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d4dd2c9ec2e40b847152b417cb6d645fdeafd31ca8a11a7a04321dd5438b40c0
Instruction ID: b211bcabfb7c3b78b92f37fdd3bf6b21a44394712590f0d15a2f7ccc23c1c9fe
Opcode Fuzzy Hash: d4dd2c9ec2e40b847152b417cb6d645fdeafd31ca8a11a7a04321dd5438b40c0
Instruction Fuzzy Hash: E9218331B0CACC8FE754DE988C8876A72E1FF88365F91463FE54AC3592DA3898858741

Function 00007DF42F52C70C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF42F52C764

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 47ebd45c6b9b16ee77b28bcb10b07460bf5cba96d3288197dd2caf634787b8b3
Instruction ID: 38dca8f98aed8be72cf99c913acf8865420ebf2a75cd5857604f4aa8811f1736
Opcode Fuzzy Hash: 47ebd45c6b9b16ee77b28bcb10b07460bf5cba96d3288197dd2caf634787b8b3
Instruction Fuzzy Hash: 58219331B0C9C88FE7549E988CC866B76E0EF98361F94063FE54EC3652DB6899C48781

Function 00007DF42F502634 Relevance: 3.3, APIs: 2, Instructions: 293threadinjectionCOMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007DF42F50273A
SuspendThread.KERNELBASE ref: 00007DF42F50277C

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: CloseHandleSuspendThread
String ID:
API String ID: 1038686644-0
Opcode ID: ee8ed1484b309d5b480d9ed41d064abcb8b4e034361352156597246fbc6f772d
Instruction ID: 02bc7fce828535cc613f4046454a794ea94745e4463fa96265fff722e3c21f80
Opcode Fuzzy Hash: ee8ed1484b309d5b480d9ed41d064abcb8b4e034361352156597246fbc6f772d
Instruction Fuzzy Hash: 0891A830B0CA95CBFB689F18DC9557A73E1FF49320B55417ED84FC6586DA28E882CB81

Function 000001C4B1601CD0 Relevance: 3.3, APIs: 2, Instructions: 278
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001C4B1601F6E
CloseHandle.KERNELBASE ref: 000001C4B1601F77

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID: AcceptCloseConnectHandlePort
String ID:
API String ID: 3811980168-0
Opcode ID: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction ID: dc473f4deff917551f7dd3e0707541e44ad584af7aa946c0913257b3ff9c6f7b
Opcode Fuzzy Hash: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction Fuzzy Hash: 8591F630548E098FEB65EF6CC495BE573E0FB94310F14465EE48BC3296EA35EC828B81

Function 000001C4B1600AC8 Relevance: 3.2, APIs: 2, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001C4B1600BFD
NtAcceptConnectPort.NTDLL ref: 000001C4B1600C47

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction ID: 00a056884c1086f71fbefd629cd1f8915dffc05a173d7470a52f062d37af9d2e
Opcode Fuzzy Hash: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction Fuzzy Hash: 85413930E5CA550BF328A67C88EABB9B7D1F7C5349F30456EE4E6C2192DA39CD438641

Function 000001C4B1601A90 Relevance: 3.2, APIs: 2, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001C4B1601AD5

Part of subcall function 000001C4B160185C: GetProcessMitigationPolicy.KERNELBASE ref: 000001C4B160192F

NtAcceptConnectPort.NTDLL ref: 000001C4B1601BCF

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$MitigationPolicyProcess
String ID:
API String ID: 2923266908-0
Opcode ID: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction ID: e5865aec024e5cb31b8df0425ae36a18e1c38858d84cd0d96b667bad69edb816
Opcode Fuzzy Hash: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction Fuzzy Hash: 6B41E230208B498FDB54DF2C98C9B957BD1FB59320F0443AEE85ACB2D7DA34D9058795

Function 00007DF42F554088 Relevance: 3.1, APIs: 2, Instructions: 93networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF42F5541A9), ref: 00007DF42F5540B5

Part of subcall function 00007DF42F553C98: ioctlsocket.WS2_32 ref: 00007DF42F553CC4

bind.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF42F5541A9), ref: 00007DF42F55413A

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: bindioctlsocketsocket
String ID:
API String ID: 3555158474-0
Opcode ID: 1cbeedcb49cdd83f56073e3a9aa9cf65c2d138516cd5c7d59cce1983b39e0131
Instruction ID: 04c2a6991e8f273a15457c0d071e9b5519c374088250931bcc90d45f5082f176
Opcode Fuzzy Hash: 1cbeedcb49cdd83f56073e3a9aa9cf65c2d138516cd5c7d59cce1983b39e0131
Instruction Fuzzy Hash: 1421F8307089848FFB489F38DC8966633E1EF55375F50067AD82FC72D6DA28BC458651

Function 00007DF42F52D3C0 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52D42D
NtAcceptConnectPort.NTDLL ref: 00007DF42F52D481

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 9166209b5f367574360b80d64ced2ea26e8fa752ef609ccd6263efb912702e76
Instruction ID: e35ec3198b56903d2efc330e1e7bc0c5abf298c749380c3504feab5a52494f78
Opcode Fuzzy Hash: 9166209b5f367574360b80d64ced2ea26e8fa752ef609ccd6263efb912702e76
Instruction Fuzzy Hash: CB21153061CE498FEB55EF58D848B6673F1FBA9345F00452EE48AC35A0DBB5E884CB41

Function 00007DF42F52D2F4 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52D361
NtAcceptConnectPort.NTDLL ref: 00007DF42F52D3B8

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 98531d878e0ad7d3d6690ce9736b63ba0a61470b6d8d195234036ffb9fe9491b
Instruction ID: 7e4f28cbeddf2b64c1ef7cf94795915e872ae6e5305c3f4f825f533bb2632edb
Opcode Fuzzy Hash: 98531d878e0ad7d3d6690ce9736b63ba0a61470b6d8d195234036ffb9fe9491b
Instruction Fuzzy Hash: 9621123061CA48CFEB49EB58D884766B7F1FBAD341F00452AE44AC36A0DBB5E984CB41

Function 00007DF42F515C08 Relevance: 2.2, APIs: 1, Instructions: 915COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e20bba79d5c3b0e0331523f810a856d8c8437985a2a7f24b7c18931845c8e3
Instruction ID: 4e9ebb476b12ac9e16225de8af21e4a795c3e9671bac57239dfca4a30cad91d3
Opcode Fuzzy Hash: 03e20bba79d5c3b0e0331523f810a856d8c8437985a2a7f24b7c18931845c8e3
Instruction Fuzzy Hash: 4A522F3061CA888FEB55EF18C8859A673E1FF98714F94467AD44EC7296DE34F881CB81

Function 00007DF42F554D8C Relevance: 1.8, APIs: 1, Instructions: 281networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF42F554EF2

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 653fe3a6da9e8edf6d7f9aad963387fd79a7ca64ce6bed9a03fbf4fad2203229
Instruction ID: 05c618d5c67a1a60f0b2115a9c862c8037747f5818a97eb5eb618a48867b1fc7
Opcode Fuzzy Hash: 653fe3a6da9e8edf6d7f9aad963387fd79a7ca64ce6bed9a03fbf4fad2203229
Instruction Fuzzy Hash: 4DA1AF30B18AC5CFFB94DB1889846A6B7F0FF553A8F90013AD45FD2692D738F8958681

Function 00007DF42F52C47C Relevance: 1.8, APIs: 1, Instructions: 260nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52C53C

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1a40425d81a0dda3cd82788b19327da5a379df3b5c3bd351d49e58af76a5eeec
Instruction ID: 7ea66644c18251dbb2d8e267520c920ccf25f5721e17ff6df04db6065d9cc77e
Opcode Fuzzy Hash: 1a40425d81a0dda3cd82788b19327da5a379df3b5c3bd351d49e58af76a5eeec
Instruction Fuzzy Hash: 98816831B1CAC9CBF7659A989C5866B73E0FF54360F90573AD44BC7193DE68F8808681

Function 00007DF42F52C10C Relevance: 1.6, APIs: 1, Instructions: 121nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52C187

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 5c97c20283281d0f686864c64b2abe35391f7ab31688f0fa8af160c1736108da
Instruction ID: 4bb2938603e5152af665bbeb8d66d107a73fb820be93b2c2ef29308dac59e659
Opcode Fuzzy Hash: 5c97c20283281d0f686864c64b2abe35391f7ab31688f0fa8af160c1736108da
Instruction Fuzzy Hash: EF31853171C9899BF7185E589C8A57A73E0EF49335F50463EE94FC3293D918B8434681

Function 00007DF42F522258 Relevance: 1.6, APIs: 1, Instructions: 114encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007DF42F5222E1

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: a07a12428c7964199d363ccabf4b149c9f1c56c6408fd6f078d364f4c66a6574
Instruction ID: beb736b9036628557a6db038132fdbdc1a77b9df9a1ab0751e970d656073cc4e
Opcode Fuzzy Hash: a07a12428c7964199d363ccabf4b149c9f1c56c6408fd6f078d364f4c66a6574
Instruction Fuzzy Hash: 7731703071CA888FE748DB68D88966BB7E1EF98311F40457EF58AC3291DE74D8428B46

Function 000001C4B16015AC Relevance: 1.6, APIs: 1, Instructions: 76
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,00000000,000001C4B1601E16), ref: 000001C4B1601640

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction ID: c26ab6a348b8e1756c12f6bed198851a68897b62c09dc12f64c54cfe0495d9b5
Opcode Fuzzy Hash: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction Fuzzy Hash: E821A57151CB09CFEB59DF68C8C9AAAB7E1FB68305F040A2EE44AC7260D731D884CB41

Function 00007DF42F52ADD4 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52AE23

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: af3340e2b301fb20eba4bd36f70d30fdbe005acca17dd1e0c445e9428843075b
Instruction ID: 3e8930aa86f5ea7d5b3dedb38b81bcacf0094084946b8bacabfd0573780bf2a2
Opcode Fuzzy Hash: af3340e2b301fb20eba4bd36f70d30fdbe005acca17dd1e0c445e9428843075b
Instruction Fuzzy Hash: A4F0D030A1CB848FDBA4FF2CD8C5B5977E1FB98310F504519E44CC3245EB3498808B46

Function 00007DF42F52AC0C Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52AC70

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d99824a7b56689602d55d9b975c23b4966fb1dfc1a28fa016acf5b8b83f0fdf8
Instruction ID: 76b06c75736ca9e0ee7d5d160c4fcb05ad7f951d36c2d7f2f3db325f4640f09a
Opcode Fuzzy Hash: d99824a7b56689602d55d9b975c23b4966fb1dfc1a28fa016acf5b8b83f0fdf8
Instruction Fuzzy Hash: AFF06634A1C7C48FE7A1DB688440B5ABBF0BB9A350F544A1DE4CCC3211D73595848B43

Function 00007DF42F52AF60 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,00000000,?,?,00000000,00007DF42F51341C), ref: 00007DF42F52AF8A

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1d9a6f3c19fc3a1664a9a6811ff4ba6c27299ee4e4794d390710366357d59dbc
Instruction ID: 3714dbbc23ac075fe62324326e7aafcdfbd59da79f736ed3fe2ede808a23c15c
Opcode Fuzzy Hash: 1d9a6f3c19fc3a1664a9a6811ff4ba6c27299ee4e4794d390710366357d59dbc
Instruction Fuzzy Hash: D9E09B756186458FEB04DF94CCC186AB3F0FBD9310F404E7AF84AC7164D668D698CA82

Function 00007DF42F589F04 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,00007DF42F59B7C7,?,?,?,?,00000000,00000000), ref: 00007DF42F589F21

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d72fac8d1d1b7f96bb5fe0759d88f2d5c6e0343dfc4f10e03c2c9322f33a3d86
Instruction ID: 7174415a9e86941a569d779037946c949436a525ac647457b473232a0f938ad3
Opcode Fuzzy Hash: d72fac8d1d1b7f96bb5fe0759d88f2d5c6e0343dfc4f10e03c2c9322f33a3d86
Instruction Fuzzy Hash: EAE01A31A188998BF30DFB30DC958E73261EF64310B914636A807820A6ED2C66898681

Function 00007DF42F52AE5C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52AE77

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: eb8f498348e5c7f372421b27a3827434041340d731fc3728b954386bc4ea4cc4
Instruction ID: 87409ddaf0ea9037519c75bc5cf10a271c8fe7b39cc51fc48d09c306ac4bce77
Opcode Fuzzy Hash: eb8f498348e5c7f372421b27a3827434041340d731fc3728b954386bc4ea4cc4
Instruction Fuzzy Hash: 07D05E20A28AC98BE650B7688D4020637E2FB95314F914724E44EC2210D62CE44242C2

Function 00007DF42F52ACE8 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52AD03

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: a9327488733b823840a3f29582a089392b2a1446868cb63a967a810240f58cb8
Instruction ID: f30c4dec86b9de7c3f9c91dd9f5014eaa19e9008652ae79fc79867c7179b13ae
Opcode Fuzzy Hash: a9327488733b823840a3f29582a089392b2a1446868cb63a967a810240f58cb8
Instruction Fuzzy Hash: A7D05E30A68AC98BE610A768880061637E1FFD4314FD44624E849C2240DA3CE4818286

Function 00007DF42F52AD14 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52AD2F

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 4927af5c10e17f27f2edd3b7dd4d43612d79bd47543f67f71f12626d98bff908
Instruction ID: c2a1636a52865d93193669f6712eec686cdaf9256e17aaff71e138b0610b8e3f
Opcode Fuzzy Hash: 4927af5c10e17f27f2edd3b7dd4d43612d79bd47543f67f71f12626d98bff908
Instruction Fuzzy Hash: D2D05E30E68AC98BE614A768890020A36E2FFD5318FD04624E849C2250DA3CE4418782

Function 00007DF42F52AF40 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52AF50

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 953671860da08bf31fab518e05a010f803d920f951da2702e38e3d0cf3acdea6
Instruction ID: b72fc824f067012e7fcbf254408a77c21d00d560c0adaaf5ebf2b273d251265e
Opcode Fuzzy Hash: 953671860da08bf31fab518e05a010f803d920f951da2702e38e3d0cf3acdea6
Instruction Fuzzy Hash: 2CC08C04B6988BCAF90862EA6CC035922A0AF48320FC00121F80EC2180E80CE6D443D2

Function 00007DF42F52ACC8 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF42F52ACD8

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 333093483b5b65ac6ab85e83ccc52a142bbc301cae1d85d61a22b47e66de8b6c
Instruction ID: 338ae6072feaeea37dc5ad992a5aadf851832deb8e88387abd921c3ab0e8381d
Opcode Fuzzy Hash: 333093483b5b65ac6ab85e83ccc52a142bbc301cae1d85d61a22b47e66de8b6c
Instruction Fuzzy Hash: 24C08C20B2CC8B8BF91862FD8D8164520A0AF4C324FC20120F80AD2281E80CE4E49392

Function 00007DF42F5165E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF42F516640
VirtualProtect.KERNELBASE ref: 00007DF42F516669
VirtualProtect.KERNELBASE ref: 00007DF42F516685
VirtualProtect.KERNELBASE ref: 00007DF42F5166B0

Strings

rE\, xrefs: 00007DF42F5165FE

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: dc7abe3753608a406b2e8c4677f2e3e348cb1d8b9abc271147da51083885c1c3
Instruction ID: f68890e5c90e2f221b1533ca792f68550023c2ce3245a46a95675b8710e2174d
Opcode Fuzzy Hash: dc7abe3753608a406b2e8c4677f2e3e348cb1d8b9abc271147da51083885c1c3
Instruction Fuzzy Hash: 5B21743171C9888BEB44EB589C916AB72E6FBD8710F500039E84BC3286DE68ED4587C2

Function 00007DF42F513178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF42F5131FA
VirtualProtect.KERNELBASE ref: 00007DF42F513224

Strings

, xrefs: 00007DF42F5131DB

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 45ee73fde44b844a7982fd6fa2bb9a274e67d6e904138dbe31d6ae3e461be495
Instruction ID: e7cdf8ecd46774a044c6ac9a97279b22a3b77ed01dee93cc0e7752d2795488b2
Opcode Fuzzy Hash: 45ee73fde44b844a7982fd6fa2bb9a274e67d6e904138dbe31d6ae3e461be495
Instruction Fuzzy Hash: 8D11E73160889A4BFB15A718DC646B773F1EF84324F944176E45BC31E2DA1CF892C781

Function 00007DF42F553C98 Relevance: 4.6, APIs: 3, Instructions: 117COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007DF42F553CC4
CreateIoCompletionPort.KERNELBASE ref: 00007DF42F553CFA
SetFileCompletionNotificationModes.KERNEL32 ref: 00007DF42F553D40

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: Completion$CreateFileModesNotificationPortioctlsocket
String ID:
API String ID: 1455841399-0
Opcode ID: b0ef64daf23010be4df91d754ff29401ba7eeb6e21b37df906d22bfb74ec9eab
Instruction ID: 54bfb1e0fdcef6c0fd2abed016cb7026155f3c91eef10242515d6ab0c32b78b1
Opcode Fuzzy Hash: b0ef64daf23010be4df91d754ff29401ba7eeb6e21b37df906d22bfb74ec9eab
Instruction Fuzzy Hash: 2D3181307089D48BFB689B689C8563632F6FF553A5F90007AE80FC6193DA29FC818691

Function 00007DF42F526654 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 00007DF42F52669B
CoUninitialize.COMBASE ref: 00007DF42F526703
free.MSVCRT ref: 00007DF42F526711

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: InitializeUninitializefree
String ID:
API String ID: 1169324116-0
Opcode ID: 300bfe15e1352cda4c3c9a5eb26de8ea91f06f6889c64728d4398b9a5c111e42
Instruction ID: 79d98480a09b65f75c2a376f5a2eee45080a4f8be59ac2a67e4830b3cb38f0e0
Opcode Fuzzy Hash: 300bfe15e1352cda4c3c9a5eb26de8ea91f06f6889c64728d4398b9a5c111e42
Instruction Fuzzy Hash: 34215330609A498FEF84EF78D859A9A77E0FF94325F04462AE84FD3151CB38E941CB90

Function 00007DF42F5172D0 Relevance: 4.5, APIs: 3, Instructions: 746COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF42F504BE4: malloc.MSVCRT ref: 00007DF42F504C0D

calloc.MSVCRT ref: 00007DF42F517551
free.MSVCRT ref: 00007DF42F5175BD
free.MSVCRT ref: 00007DF42F517AB3

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free$callocmalloc
String ID:
API String ID: 1437353635-0
Opcode ID: 6cebd9367394abf21773eb1584d65681aa51e4210b0eb886ea29ebe4f46530e1
Instruction ID: 8ccd8625e7c497d8897a8997fcbc6f430bf08d59632f3f0d5d385b37792f49e6
Opcode Fuzzy Hash: 6cebd9367394abf21773eb1584d65681aa51e4210b0eb886ea29ebe4f46530e1
Instruction Fuzzy Hash: 3E421C30618E888FEB55EF28D8896ABB7E1FF58310F50462AD45FC7252DB34B585CB81

Function 00007DF42F504BE4 Relevance: 3.9, APIs: 3, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF42F504C0D
malloc.MSVCRT ref: 00007DF42F504C6C
free.MSVCRT ref: 00007DF42F504CD0

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: f833b09acc7dcda6218a08ced81fc052c99920b07a41f041528abf3627ace0e1
Instruction ID: 22894c8ddb0cbec72780527f58ce8b7d63cde29033206ce27d56f84fcc1ff88b
Opcode Fuzzy Hash: f833b09acc7dcda6218a08ced81fc052c99920b07a41f041528abf3627ace0e1
Instruction Fuzzy Hash: ED318230708A899BBB58EE65DC49966B3F0FF58320740423FD81BC6592EF64F89187C1

Function 000001C4B30033B0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 344memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 000001C4B30036F9

Strings

l, xrefs: 000001C4B30033D6

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID: FreeHeap
String ID: l
API String ID: 3298025750-2517025534
Opcode ID: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction ID: 09420e10e428afcd77b8b9fcc14c9990db84c508ade84c0cfd1ac0ced20c742c
Opcode Fuzzy Hash: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction Fuzzy Hash: A5A1163151CA5D0BE76A9B3988A1BFE73E1EF85708F1005AEE8C7C318BDD24DD068685

Function 00007DF42F5195F8 Relevance: 3.4, APIs: 2, Instructions: 397COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF42F52AF60: NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,00000000,?,?,00000000,00007DF42F51341C), ref: 00007DF42F52AF8A

CreateFileMappingW.KERNELBASE ref: 00007DF42F5198AE
calloc.MSVCRT ref: 00007DF42F5199E8

Part of subcall function 00007DF42F519478: CreateFileW.KERNELBASE ref: 00007DF42F5194D0

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: CreateFile$AcceptConnectMappingPortcalloc
String ID:
API String ID: 2835849967-0
Opcode ID: d1b445dc56701135788b0dc920e68535db059dd4faca11d9a453a424e093dfee
Instruction ID: eedcbe0483182a5115633e40a41413f37966ead51c15fa6ecd42775336ecdb4b
Opcode Fuzzy Hash: d1b445dc56701135788b0dc920e68535db059dd4faca11d9a453a424e093dfee
Instruction Fuzzy Hash: 8ED14F31A1CBC88BE765AF18D8956ABB7E1FF94310F44462EE48FC3152DF34A5458B82

Function 00007DF42F52DDA4 Relevance: 3.2, APIs: 2, Instructions: 238fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007DF42F52DEBA
ReadFile.KERNELBASE ref: 00007DF42F52DFA2

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: File$CreateRead
String ID:
API String ID: 3388366904-0
Opcode ID: b879bc7b5dc6143657be184a8553957d82cf9a437ba6bdf4bbb2c4680e42a6eb
Instruction ID: 5e8f0628e2f84d5556ab9ff6b51e8f835f9f69db5e9fc2ac8db8a7fe3b3e62f3
Opcode Fuzzy Hash: b879bc7b5dc6143657be184a8553957d82cf9a437ba6bdf4bbb2c4680e42a6eb
Instruction Fuzzy Hash: 65716570718A848FE7589F5898C576AB6E1FF98311F50063FE58FC3293DF34A8868646

Function 00007DF42F5022DC Relevance: 3.2, APIs: 2, Instructions: 222memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 00007DF42F5022F4
VirtualAlloc.KERNELBASE ref: 00007DF42F5023C0

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 10974d638571623cb466fc5259723849182c6a649d453933aa228a33d07da908
Instruction ID: cae15dd79affff7568d1b37ed66be656365007a964001ba287c1b5cf819fedf5
Opcode Fuzzy Hash: 10974d638571623cb466fc5259723849182c6a649d453933aa228a33d07da908
Instruction Fuzzy Hash: 5451B33071CE9D8FF755AE68984877A72E1FF9C320F84017ED84EC3196EA68D8C58681

Function 00007DF42F519478 Relevance: 3.2, APIs: 2, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007DF42F5194D0
ReadFile.KERNELBASE ref: 00007DF42F519585

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: File$CreateRead
String ID:
API String ID: 3388366904-0
Opcode ID: 73db5555d885fd7ea61d85234132b183eb459049274d5711c35081ec0b7aef7a
Instruction ID: 5f37dafb25c354ddebecb435125d92ff28984bf88e6c78bd6bce8b0a89694a70
Opcode Fuzzy Hash: 73db5555d885fd7ea61d85234132b183eb459049274d5711c35081ec0b7aef7a
Instruction Fuzzy Hash: 6741B0307086888FEB58EF289C9566B73E5EF98715F10453EE98FD3251EE24E8418782

Function 00007DF42F52D974 Relevance: 3.1, APIs: 2, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007DF42F52D9AB
ReadFile.KERNELBASE ref: 00007DF42F52D9E1

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: File$CreateRead
String ID:
API String ID: 3388366904-0
Opcode ID: 6dcf9cfff2eacf5cd94369649f002897bcffdea66228e64647734ab7a70026dd
Instruction ID: 502035482ae477c53120156aeb8394166ad223726a51df8114c31f05794ead60
Opcode Fuzzy Hash: 6dcf9cfff2eacf5cd94369649f002897bcffdea66228e64647734ab7a70026dd
Instruction Fuzzy Hash: 1721B77170C7884FF7549E999C8667B73D4EB89721F50023FE88FC2242DF64A8464686

Function 00007DF42F502980 Relevance: 3.1, APIs: 2, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF42F5029BF
VirtualProtect.KERNELBASE ref: 00007DF42F502A25

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e54d32ce24f4b710544f648fa16c64d8d7f0589b34fc61474f65512f49413183
Instruction ID: 17c92d8a60818a58096b19d7d3e06cbcad8458c6d7ffc22f2652c6ecadd3c73a
Opcode Fuzzy Hash: e54d32ce24f4b710544f648fa16c64d8d7f0589b34fc61474f65512f49413183
Instruction Fuzzy Hash: 4131E82070C6C58BE7149F6C9C947763BD1EF59320F5502B9EC8EC72C6CB589882C381

Function 00007DF42F504774 Relevance: 2.7, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF42F50494C
free.MSVCRT ref: 00007DF42F5049F3

Part of subcall function 00007DF42F504620: malloc.MSVCRT ref: 00007DF42F5046EF

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 352f2f2cecbb3e27f866ef48949e4e4dcfd5ee98b9eced5f0af6e5ea8a5601e0
Instruction ID: 3f0e299deebd752cb59b694df518bbee922818750d504a649d40182192e0804c
Opcode Fuzzy Hash: 352f2f2cecbb3e27f866ef48949e4e4dcfd5ee98b9eced5f0af6e5ea8a5601e0
Instruction Fuzzy Hash: 8971983171C9D48AF329AB189C956EB72E1FF95310F80497FE48FC3183DD38A5858685

Function 00007DF42F51CC5C Relevance: 2.6, APIs: 2, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF42F52ACC8: NtAcceptConnectPort.NTDLL ref: 00007DF42F52ACD8

malloc.MSVCRT ref: 00007DF42F51CD0D
free.MSVCRT ref: 00007DF42F51CD94

Part of subcall function 00007DF42F523848: malloc.MSVCRT(?,?,?,?,?,FFFFFFFF,-00000001,-00000002,-00000001,00007DF42F542CFA), ref: 00007DF42F523867

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc$AcceptConnectPortfree
String ID:
API String ID: 342249184-0
Opcode ID: 694a03a6a0a341675988201f7685504af8169e7f1b53cb1e5f9007a100a90dea
Instruction ID: 1ad8eeda60e37e13d150853511f0be8517ef815818658f49052289e160d2e9a7
Opcode Fuzzy Hash: 694a03a6a0a341675988201f7685504af8169e7f1b53cb1e5f9007a100a90dea
Instruction Fuzzy Hash: 9B414171608A8C8FEB54EF58D8856A677E1FF58311F40057AE84EC7252DF34E985CB82

Function 00007DF42F51CA08 Relevance: 2.6, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,?,?,?,?,?,?,?,-00000001,00007DF42F51D046), ref: 00007DF42F51CA30

Part of subcall function 00007DF42F52BCC0: NtAcceptConnectPort.NTDLL ref: 00007DF42F52BD8F

free.MSVCRT ref: 00007DF42F51CA66

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPortcallocfree
String ID:
API String ID: 1866692179-0
Opcode ID: 1c81860f17a6367f43a2a94f10a5d32e0a9fa92ddff0a1d18b0803ced88c0a31
Instruction ID: 39dddc107d151e15bdca9bf8d2039ce795f84d5bc9868356c7ee30aa137abb00
Opcode Fuzzy Hash: 1c81860f17a6367f43a2a94f10a5d32e0a9fa92ddff0a1d18b0803ced88c0a31
Instruction Fuzzy Hash: 14F0F431314D0C4FE748AB2C9C886A637E1EB94736754463AE00AD3261DD68D9408780

Function 00007DF42F526720 Relevance: 2.2, APIs: 1, Instructions: 947COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF42F526956

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 4c67779dd63165b43659fab8fd510d9b574d13d676e16a29e3859926c8de3004
Instruction ID: a88aeb49ad7bc0f4abdf2cb9e23738188c0a4446ce34b92041a849e5fb6d3fbd
Opcode Fuzzy Hash: 4c67779dd63165b43659fab8fd510d9b574d13d676e16a29e3859926c8de3004
Instruction Fuzzy Hash: EA72473061CAC8CBE769EF58C895ADA73E1FF94310F50466ED48F83197DE34A5858B81

Function 00007DF42F5C6E40 Relevance: 1.9, APIs: 1, Instructions: 678COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F5C7425

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5cfc4201fb7c4a5cd7dc6236c97b00fa7328bf45963e63035016e6d7be0ff961
Instruction ID: 6557b0ac4bb3a14ce0d34d5590db604cff068d788f6de057a15bd6f9e4dc5ddf
Opcode Fuzzy Hash: 5cfc4201fb7c4a5cd7dc6236c97b00fa7328bf45963e63035016e6d7be0ff961
Instruction Fuzzy Hash: 7D32A230B1CACD8EE7599A2898856A677E1FF54320F94457ED08FC3593E628E9C2C781

Function 00007DF42F51913C Relevance: 1.8, APIs: 1, Instructions: 316COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE ref: 00007DF42F519372

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 090a60165b6d81dbbef6ccd1718067ffa9bcceaffdfa6db13320491a5d5642c1
Instruction ID: 180461fc456f81bc2b6cc6312cfd823b7d1950382657bfeb795d861b0fefb2ef
Opcode Fuzzy Hash: 090a60165b6d81dbbef6ccd1718067ffa9bcceaffdfa6db13320491a5d5642c1
Instruction Fuzzy Hash: 6FA12E31608A888FEB55EF54C8959ABB7F1FF94310F90463EE44FC7192DA34A985CB81

Function 00007DF42F525004 Relevance: 1.7, APIs: 1, Instructions: 245registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007DF42F525225

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e8d5d7329d2320a05d82013e26ca3d8c66ee9948d03da3e8e50157f1609a8dd5
Instruction ID: ccc7e02c0eb93efcea34525581a6afccd698fe30a7f052db6768f3b62a1a1e1d
Opcode Fuzzy Hash: e8d5d7329d2320a05d82013e26ca3d8c66ee9948d03da3e8e50157f1609a8dd5
Instruction Fuzzy Hash: 5891BB3161DB888FE765EF65C889B9BB7E1FF98301F40492AE48AC3261DB34D544CB42

Function 00007DF42F554B28 Relevance: 1.7, APIs: 1, Instructions: 227networkCOMMON

Download Yara Rule

APIs

WSASend.WS2_32 ref: 00007DF42F554BDF

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: d8e018eafecf73722f3cfd2108c578dd3fd3213e6426fbbfe5b50f999653df9c
Instruction ID: 2c3d71a4882d19b959648a07d48d7a70a407d71515542861bf7c76c600a9783d
Opcode Fuzzy Hash: d8e018eafecf73722f3cfd2108c578dd3fd3213e6426fbbfe5b50f999653df9c
Instruction Fuzzy Hash: 15815E70608A89CFEB98DF28C4947A6B7E0FF54364F50467AD44EC7692DB35E890CB81

Function 00007DF42F515960 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 00007DF42F515B1D

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 458a1419ed12d8a3c2e86420f2914f8409b820493848f008ec8053e1bf8f0b77
Instruction ID: 1ebbc4c27294cf0afe452b1312b464b49a716c22730e4f97a455134b9c7097e0
Opcode Fuzzy Hash: 458a1419ed12d8a3c2e86420f2914f8409b820493848f008ec8053e1bf8f0b77
Instruction Fuzzy Hash: 3E615E7160CA888BE765EF54D8846DBB7E1FF98310F404A2EE08BC3152DF35A585CB42

Function 00007DF42F52D6FC Relevance: 1.7, APIs: 1, Instructions: 176processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 00007DF42F52D7F5

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e9169745a3f5c8f3addee9eb58fc29d082d9d243fdbbd28d7b824531286ef21a
Instruction ID: e4ece0dcfd71f63ff364f464bb08d7800e426f678c8642c9bafa5666d4731ac1
Opcode Fuzzy Hash: e9169745a3f5c8f3addee9eb58fc29d082d9d243fdbbd28d7b824531286ef21a
Instruction Fuzzy Hash: 18510D3161C6888BF7649B9898557ABB7E5EF94320F41063EE48BC3292DF78E8418752

Function 00007DF42F554520 Relevance: 1.7, APIs: 1, Instructions: 167networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF42F5545BF

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 7916fdf4d3e942b440d7f5c412e90116e139ebed5d60f444feec34680a904e5a
Instruction ID: f9c571524623e091c37660024342648d99426e464e1a0fa52aeb04dbfa9253c4
Opcode Fuzzy Hash: 7916fdf4d3e942b440d7f5c412e90116e139ebed5d60f444feec34680a904e5a
Instruction Fuzzy Hash: 06514B70608A89CFEBA4EF29C898B9677F0FF54364F90056AD44BC7562DB39E484CB41

Function 00007DF42F528F84 Relevance: 1.7, APIs: 1, Instructions: 414COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F5293FA

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2b200ceb4e4cc9f035faf7b6c1b247c7413155f6bad845cc72cf0ce4a6dd00dc
Instruction ID: f25596e5474b8e34564650f22366ff7338115e9d7f1135d9e1334624fc0e5f60
Opcode Fuzzy Hash: 2b200ceb4e4cc9f035faf7b6c1b247c7413155f6bad845cc72cf0ce4a6dd00dc
Instruction Fuzzy Hash: E1D13F3161CAC88BFB65EF5488956EB73E1FF94350F80063ED44FC3196DE78A9858682

Function 00007DF42F517B7C Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF42F5165E0: VirtualProtect.KERNELBASE ref: 00007DF42F516640
Part of subcall function 00007DF42F5165E0: VirtualProtect.KERNELBASE ref: 00007DF42F516669
Part of subcall function 00007DF42F5165E0: VirtualProtect.KERNELBASE ref: 00007DF42F516685
Part of subcall function 00007DF42F5165E0: VirtualProtect.KERNELBASE ref: 00007DF42F5166B0

TlsFree.KERNELBASE(?,?,?,?,?,?,?,00000000,?,?,00000000,00007DF42F51341C), ref: 00007DF42F517CB7

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual$Free
String ID:
API String ID: 3841229516-0
Opcode ID: 9454607179550a56fcb25c77309fc397396c8818e949c4bf6b88fbdfb1fa50f0
Instruction ID: e4156e77726c780098c59360b9610677b1b4ee27878fead0c170d83f49796594
Opcode Fuzzy Hash: 9454607179550a56fcb25c77309fc397396c8818e949c4bf6b88fbdfb1fa50f0
Instruction Fuzzy Hash: A7418930708A888BFB54EF68A8C556B73E1EF49764B404577E41BC7587DA28F8818792

Function 00007DF42F513320 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF42F503DD8: RtlAddFunctionTable.KERNEL32 ref: 00007DF42F503E05

SetErrorMode.KERNELBASE ref: 00007DF42F513408

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: ErrorFunctionModeTable
String ID:
API String ID: 928017140-0
Opcode ID: d9c23544fbb2a9f569b4c70e99ee3ada11af114710c16124923c5dd5b1b488fd
Instruction ID: 4e88526dbb9f62479dba0fbd323b661c09c79408795334d9917663669beb0511
Opcode Fuzzy Hash: d9c23544fbb2a9f569b4c70e99ee3ada11af114710c16124923c5dd5b1b488fd
Instruction Fuzzy Hash: 8531732171C9C98BFE54FB689C9656B72E1EF48324B94053ED40FC32D3D918BDC68685

Function 00007DF42F5552D0 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF42F555344

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 5ecb9aca37cfa74a852660f22e24977ddf5ffe3d9d8c212dab6545ea967c75f3
Instruction ID: d668427c4d3f0fe70cbf4017084c0b03b748fb92600bc4c908ccfa21518e4516
Opcode Fuzzy Hash: 5ecb9aca37cfa74a852660f22e24977ddf5ffe3d9d8c212dab6545ea967c75f3
Instruction Fuzzy Hash: 65310D70A14A858FFB98DF18C48876177E1FF54369F5102BAD81ECB2E6D774A885CB40

Function 000001C4B160185C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessMitigationPolicy.KERNELBASE ref: 000001C4B160192F

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction ID: 2d2c8768447a227b29a6a3ad2200e227c5ec84be328d5df344238fc8ee74ccab
Opcode Fuzzy Hash: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction Fuzzy Hash: 73319130248A0BCBFB6597B888E8FE173D5EB943A1F1C01B9A665CA1D1DE75DC81C740

Function 00007DF42F51B764 Relevance: 1.6, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F51BAA3

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c8a5416c91b5153a76d254bfa4ef07326f1cac8c2947bbd921b64d27c5c1bc1f
Instruction ID: 99741a1d0a8a228cf66cc904e2a8dbfc095d19cbd9bf33aada1b5d0d95a7d6c0
Opcode Fuzzy Hash: c8a5416c91b5153a76d254bfa4ef07326f1cac8c2947bbd921b64d27c5c1bc1f
Instruction Fuzzy Hash: ABB1BE30B189889FEB48EF28C891A9777E1FF58314B904676D40BC7297DE28F995C781

Function 00007DF42F502910 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00007DF42F502948

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a1e79bfd5fdfa4d599be838d72d64bf9e685b5698f2b0b05ab8498b458f49234
Instruction ID: d6c3e7699f159715c5dcd54c3131907fd1fbabbd466c4acc65f52fc8a743e0ea
Opcode Fuzzy Hash: a1e79bfd5fdfa4d599be838d72d64bf9e685b5698f2b0b05ab8498b458f49234
Instruction Fuzzy Hash: 3D012631B149198FFB94AB69DC8823633E1FF8D361744047AE80EC3155DA39ACC2CB80

Function 00007DF42F502BB0 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 00007DF42F502BF6

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: e8b38785987ebe4bf97a71b2e294a612045f12fa57e0274daf3e7e500e703184
Instruction ID: 0471d82ebfb8de5728aa4ee07044828a1f8ae8db1b8dd557ee80e774fb56f74f
Opcode Fuzzy Hash: e8b38785987ebe4bf97a71b2e294a612045f12fa57e0274daf3e7e500e703184
Instruction Fuzzy Hash: F5011D70A096959FEB54AF69BC8613636B1FF98321784413FE40AC7962CA3858C0CB51

Function 00007DF42F502B5C Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00007DF42F502B7C

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: f6a5c260a6ff26826b95901847e0f94daf167b208f970919ab6999429e88efbf
Instruction ID: 4deb91ab9148fe4a71515329f949b518d1acdacb00b5fd500e689824e8efe50a
Opcode Fuzzy Hash: f6a5c260a6ff26826b95901847e0f94daf167b208f970919ab6999429e88efbf
Instruction Fuzzy Hash: 21F0A061B182C58BF720AF795C8113B61A29F8C322F94453FEC0FCA187DD7998C58640

Function 00007DF42F525644 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF42F52568F

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: ddedd6023ad442b8d2b2fe3290ed3783bcd232237776f9c3a295af58d00cf6c3
Instruction ID: 2f0ebc75d80a1f2bdcb0ea6f77f27800c4c0e097ef263285a351856a65a758a7
Opcode Fuzzy Hash: ddedd6023ad442b8d2b2fe3290ed3783bcd232237776f9c3a295af58d00cf6c3
Instruction Fuzzy Hash: 97F082742046044FEB48EF5CC49876677E2FFA8325F100169E90DC72E4DB369989C741

Function 00007DF42F513088 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00007DF42F5130AF

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: c2543c20c0a7d110227d86949c13dfaa5e54e54e664fb098b1aa0bdcf88303a9
Instruction ID: cd4a274a19bf8a5cf00fb83fca431b50b9f3b232fa5a328c89aa6377c196ce34
Opcode Fuzzy Hash: c2543c20c0a7d110227d86949c13dfaa5e54e54e664fb098b1aa0bdcf88303a9
Instruction Fuzzy Hash: 88E0C211B18C090B7B6862AE288CA7755D6CFDC23234402BBE81EC3296EC14CC850380

Function 00007DF42F52D8E4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007DF42F52D909

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 23f3765db31a0df280e37a6bc4f8137308a1fee0486dc2818908f898aea27d2f
Instruction ID: c076b59af0e72806b2472201f695b54bc63e28b6ed3703abb36710452691a838
Opcode Fuzzy Hash: 23f3765db31a0df280e37a6bc4f8137308a1fee0486dc2818908f898aea27d2f
Instruction Fuzzy Hash: ADE0C232B150240BF72C6ABD2C8917A36DAC7CC572705423BF80AC3284ED7C8C4602D1

Function 00007DF42F503DD8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF42F503E05

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: 3b09555bf32cd7a482aca5e21dc4f37ab037edd0c1b9afc7390cc3b8e22e33b4
Instruction ID: 44b56e50760577fc6e801f8bc076c4f28061c7330b5121857435561685e9bb47
Opcode Fuzzy Hash: 3b09555bf32cd7a482aca5e21dc4f37ab037edd0c1b9afc7390cc3b8e22e33b4
Instruction Fuzzy Hash: 56E0BF306549459BEBA8EA1DC8493503AE1FB5C316FA442BDD905C9291CB39D8DBCF81

Function 00007DF42F51305C Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00007DF42F51307E

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: a3d3fb642ff0cc57188af8378addfd77f9925b64171ee342b3230a823feed9b9
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 6BD05E10729D4D1BEA48662D1CA472611D5EBCC225B94017AE80AC2282E958CC950201

Function 00007DF42F515DE4 Relevance: 1.5, APIs: 1, Instructions: 266COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF42F515F85

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 2479110834a0a50aa720895a2966e0087a87a39eabe9dff41225e0602a7593e9
Instruction ID: 65ec48c62e51f4d2b8640cf1dfe577e0d82d016bdbe2cae08ac689c4c2a1ee34
Opcode Fuzzy Hash: 2479110834a0a50aa720895a2966e0087a87a39eabe9dff41225e0602a7593e9
Instruction Fuzzy Hash: 8381407161CA888FEB58EF18D88196673E1FF98710F51467AD44AC7296DE34F882CBC1

Function 00007DF42F515CC3 Relevance: 1.4, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F515D10

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 903acddc3c2cbd21899d181af60d2020bd4c0d22b9f6ec9809e98e44769c02c6
Instruction ID: cfc4402ec3576a92aa5de917024e5cd4a6c46ebbee3b01434338d111fcffcd04
Opcode Fuzzy Hash: 903acddc3c2cbd21899d181af60d2020bd4c0d22b9f6ec9809e98e44769c02c6
Instruction Fuzzy Hash: 93410031718D888FEB94EF18C485A96B3E1FF98310F94467AD44EC7296DA34F985CB81

Function 00007DF42F5235F4 Relevance: 1.4, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF42F5236C2

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 31b51a1252b2397096177e19cb7010b666d546ef653b70412147a1dab026b8b6
Instruction ID: 673574754a2ad9a899a3f7b9b9472eea75b7c9c9c16254737eee80c1b0bc3349
Opcode Fuzzy Hash: 31b51a1252b2397096177e19cb7010b666d546ef653b70412147a1dab026b8b6
Instruction Fuzzy Hash: 15419E30708D0E8FEB88EF6CD888A65B7E1FB68311750423BD41AC3661DB74E8948BC0

Function 00007DF42F504620 Relevance: 1.4, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF42F5046EF

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: c3b5330ba83a094f7bad87bbcfda8b7898b28b22e9f53235a9dbd9f71cfcc7c9
Instruction ID: f2a2b822b8cbdaadb43ed3e665f80d951349148e387fae10780b4a070bfab6c8
Opcode Fuzzy Hash: c3b5330ba83a094f7bad87bbcfda8b7898b28b22e9f53235a9dbd9f71cfcc7c9
Instruction Fuzzy Hash: A341C430B044D88BFB689E298DD407A37E1EF89315754817EDC6BCA587DA28E986C7D0

Function 00007DF42F5280F5 Relevance: 1.4, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF42F52820F

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 8961c0a0c51481263298dbc41ef9f1953b1f2b352ed374b4fe42b772e20abd2b
Instruction ID: 19a9cd77c0027a33fa8f53f26960e7e320b73709782e0f44f5115c2d06dacb42
Opcode Fuzzy Hash: 8961c0a0c51481263298dbc41ef9f1953b1f2b352ed374b4fe42b772e20abd2b
Instruction Fuzzy Hash: 5C41C630708A859AEAA8EB64C851B96B3E1FF54311F40463AD45FC3693DF38F8958B81

Function 00007DF42F5DB260 Relevance: 1.4, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,?,?,?,?,?,?,00007DF42F525770), ref: 00007DF42F5DB282

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 1510f62e4c51649cb4b3fc6bb3479c9fee78b3cdc066acf53db6694c8fe85d1c
Instruction ID: fd93e186a33c3ad8a0e914dd706feb194e48285c8bf28a3448f4695af9910b26
Opcode Fuzzy Hash: 1510f62e4c51649cb4b3fc6bb3479c9fee78b3cdc066acf53db6694c8fe85d1c
Instruction Fuzzy Hash: 2F41EA70909A188FEB91DF1894887D177E1FB68711F1842BBDC4DCF25ADB748885CB90

Function 00007DF42F523848 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,?,?,?,FFFFFFFF,-00000001,-00000002,-00000001,00007DF42F542CFA), ref: 00007DF42F523867

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: aa4f1f029a65678ad9f3ad1f83a567308f2cd0838b93955c777e9bc3ae762b5b
Instruction ID: a77e4ec956d6b608e8bc038b661719d91f719c7ecc3eb910be27f3afa6c299c6
Opcode Fuzzy Hash: aa4f1f029a65678ad9f3ad1f83a567308f2cd0838b93955c777e9bc3ae762b5b
Instruction Fuzzy Hash: F9219031614D1C8FEB59EF1CDC8C6A177E1EB6831171542BBD80ACB265DA35E8848791

Function 00007DF42F5FABFC Relevance: 1.3, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F5FAC91

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction ID: 93534ae3f1f89a4213e6b6340d80c1a99990462e31373d761707b5af6fef5e93
Opcode Fuzzy Hash: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction Fuzzy Hash: 4F212170B088988FEF94EB1CC4C495577A2EF993607A503B1F81AC71AAD665ECC08781

Function 00007DF42F51D5E0 Relevance: 1.3, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF42F51D619

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 14d07331c19738ae6f5dcbbc3446d40274566deaf3c6ba6d90dddde88c6f0ea8
Instruction ID: d07974a641702f8affa14d3ed9b72fbc21f1a63d78d407c3cbb74822f10ae9ec
Opcode Fuzzy Hash: 14d07331c19738ae6f5dcbbc3446d40274566deaf3c6ba6d90dddde88c6f0ea8
Instruction Fuzzy Hash: 8B21D530A18B489FE748AF989C855A677E4FF58321B40427EE44EC3262EB74B881C7C1

Function 00007DF42F512E18 Relevance: 1.3, APIs: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 00007DF42F512E40

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: dd3043cd4fdbf6ce1bec2523c8a3e90b76413ae5d3024df9cc9149889a1f6f13
Instruction ID: baf48f91f6d48140ce9e66149d3269517a0c0cbb4c6971cd6c45b00d65535d48
Opcode Fuzzy Hash: dd3043cd4fdbf6ce1bec2523c8a3e90b76413ae5d3024df9cc9149889a1f6f13
Instruction Fuzzy Hash: E5116D31B145CD9BFB5CAB389C552F736E1EF94624B84033AD80BC71A7DE28A9858640

Function 00007DF42F5E5F24 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,?,?,?,?,00000001,?,00007DF42F5E62A0,?,?,?,?,?,00000000,?,?), ref: 00007DF42F5E5F50

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: b06512987aa8d2c8df61d034f6c9c76fa6a4a0890f349fee8146c1fc6763cbd3
Instruction ID: 78be001012a65f6ab84d836365bc504152dcb42ffb59a1fa9696aee18accb576
Opcode Fuzzy Hash: b06512987aa8d2c8df61d034f6c9c76fa6a4a0890f349fee8146c1fc6763cbd3
Instruction Fuzzy Hash: 2C019B30714D498FFB84EF5C888866672A1FF98321B5485B6E82DC729ADA34DC81C780

Function 00007DF42F51BAB4 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,-00000001,00007DF42F51D0B5), ref: 00007DF42F51BAFB

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 75680fa04e19e4440b4640af9aa4d4391f4b0436c9268b337d289e293cb6ea92
Instruction ID: 27607428911ad00b5bd12cf237c21283e4655a4c05a597b56009bb5196c3ece2
Opcode Fuzzy Hash: 75680fa04e19e4440b4640af9aa4d4391f4b0436c9268b337d289e293cb6ea92
Instruction Fuzzy Hash: 8501E830204D489FEF94EB1CD4D4E5573E5EB68314B5405A6D40DCB256CA65E8C68B40

Function 00007DF42F506540 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,?,?,-00000001,?,-00000001,00007DF42F5065CE), ref: 00007DF42F506585

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction ID: 1448cfe7783a58d33e5ee13dc66c4ace7bca156533f496d12e180a29cd3cf380
Opcode Fuzzy Hash: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction Fuzzy Hash: 15016270B04A569BF7689F69D888622B7E1FF9C325F54453AD809C3285DB38E8D1CB90

Function 00007DF42F5024F4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007DF42F50254E

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 85f62002f11eda201487085593c698b0135f5f3e41b5990a1ae8dfcda2a01f33
Instruction ID: b3cffdce00d96a8194ac33829e54d62ee3ac5cf5b45256026524af0439b58757
Opcode Fuzzy Hash: 85f62002f11eda201487085593c698b0135f5f3e41b5990a1ae8dfcda2a01f33
Instruction Fuzzy Hash: 3F016730B18D898BF758DF2C9C6423132E1FF5C325794817ED40ECA2E5EA29D8C28705

Function 00007DF42F5602AC Relevance: 1.3, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,00000000,00000000), ref: 00007DF42F5602F2

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e005b8aad8ae59e5c4306d33e7cf4f806ca0153c9240256dc9db618efce1777c
Instruction ID: 239babce9b9ff28711e503085b53d9faba078c556b80cc97348871ce4c88dae1
Opcode Fuzzy Hash: e005b8aad8ae59e5c4306d33e7cf4f806ca0153c9240256dc9db618efce1777c
Instruction Fuzzy Hash: A9F0623071BA4ECBFF5CAB659C5862A3BB0EF14317B44103FD80BC11A1CA6D9890D721

Function 000001C4B16019A0 Relevance: 1.3, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 000001C4B16019E5

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction ID: d45d4fbaf7089c15b43b8bf668ad65641718ad6856008476fa02b890306119af
Opcode Fuzzy Hash: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction Fuzzy Hash: B7F0B731218A098FDF9CEFA5C8D9EA537A4EB28301F4445A99C0ACB15ADA21E985C791

Function 00007DF42F52379C Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F5237C5

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 38b5563491cec97da23afbec1dbe8fd433f77e7ca0be4d4ad2848afd0e677fff
Instruction ID: 4f216d3912c03feb7ccb108edea08c46c8cbabe810bc21b76a680c3bf7d3134a
Opcode Fuzzy Hash: 38b5563491cec97da23afbec1dbe8fd433f77e7ca0be4d4ad2848afd0e677fff
Instruction Fuzzy Hash: 4BE046306259898AEF48AB688948B5232E0FF08300F880975900AC25A0DB2CD6C0C701

Function 00007DF42F50FBE8 Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007DF42F50FBEE

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 7aac0fcb7c972547ff5d390886f6270a0f974cec2218a33fb889b5e6a18d3d37
Instruction ID: 7d0e570608a221f2a93cd43027fb65eae5100aa45d18d2a7c739e3d94641f01d
Opcode Fuzzy Hash: 7aac0fcb7c972547ff5d390886f6270a0f974cec2218a33fb889b5e6a18d3d37
Instruction Fuzzy Hash: 8DD012607058094B7B5076FB1CCE13529D4DB282127000026EC19C0161E908C8D4D751

Function 00007DF42F515BBC Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F515BC5

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b7031c71d370f0c4b9d1add862bc0dfec61c612abdfff09cb5e9d61695c69b58
Instruction ID: b9a952025fefe808d26f0e268287b3531d2d05f1873e81763227b0deebde1d31
Opcode Fuzzy Hash: b7031c71d370f0c4b9d1add862bc0dfec61c612abdfff09cb5e9d61695c69b58
Instruction Fuzzy Hash: D8B0123499BD8B82FD1C33760DD915A3960BF14215FC50035D807C0151E61ED0DA43D6

Function 00007DF42F504A20 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007DF42F504A29

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 551c0ffc82b28a3876ee79cfc9de3840c8837f1e4274ad0e5daf9a8a7b3ff23c
Instruction ID: e50cfcc4baaf63c6f2384bd676e172a819a76c85254c34afd4079fe8ab7ddb74
Opcode Fuzzy Hash: 551c0ffc82b28a3876ee79cfc9de3840c8837f1e4274ad0e5daf9a8a7b3ff23c
Instruction Fuzzy Hash: A9B09224A2688B46AD48376A0F590292661AF18212BC40029A806C0854E54C84D4A246

Non-executed Functions

Function 000001C4B1600C5C Relevance: 8.3, Strings: 6, Instructions: 796
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N, xrefs: 000001C4B1601349
MZ, xrefs: 000001C4B16011B3
PE, xrefs: 000001C4B1601003
PE, xrefs: 000001C4B16013F4
MZ, xrefs: 000001C4B16012BA
t, xrefs: 000001C4B1601351

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID:
String ID: MZ$MZ$N$PE$PE$t
API String ID: 0-755495288
Opcode ID: 2b16dde3009b830e6d4830d4e9d9741671237dbaf5c6908a7b062a13295d3e31
Instruction ID: bef116d1dd18e0ec8c5a5f85501a242dd981d7a7b355251e9a8a44ce8215bf29
Opcode Fuzzy Hash: 2b16dde3009b830e6d4830d4e9d9741671237dbaf5c6908a7b062a13295d3e31
Instruction Fuzzy Hash: 4252807055CB498BE775DF68C8D9BEAB3E0FB94310F54466ED48AC3251DB30E9818B82

Function 00007DF42F51D9F0 Relevance: 5.4, Strings: 4, Instructions: 366COMMON

Download Yara Rule

Strings

:, xrefs: 00007DF42F51DAE0
\, xrefs: 00007DF42F51DAEA
\, xrefs: 00007DF42F51DCDF
A, xrefs: 00007DF42F51DAD6

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc
String ID: :$A$\$\
API String ID: 2803490479-2970747007
Opcode ID: 36717040e98f5bfb8d7c41574989f56423647d85f12b6354c266bc161e17fab8
Instruction ID: e34173976ff8b8cf8c1c7be67760c6ecc1af32393d02b2e930cbc81d3fd66330
Opcode Fuzzy Hash: 36717040e98f5bfb8d7c41574989f56423647d85f12b6354c266bc161e17fab8
Instruction Fuzzy Hash: 26C1623161CA888BE769EB18DC956AB73E1FF94714F50063ED08BC7193DB78B8468781

Function 00007DF42F57CFB4 Relevance: 5.3, Strings: 3, Instructions: 1537COMMON

Download Yara Rule

Strings

%, xrefs: 00007DF42F57D48C
<, xrefs: 00007DF42F57DC24
gfff, xrefs: 00007DF42F57D947

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID: %$<$gfff
API String ID: 0-3580006562
Opcode ID: 6c2073ed2742cc9f5ac50db97c88eab35f2bafc9ade6470d2e1ba03dfd860329
Instruction ID: 328ef6f408e19b6096b882879d4f9213a2634f766361b8c2457ce0d81d5a281b
Opcode Fuzzy Hash: 6c2073ed2742cc9f5ac50db97c88eab35f2bafc9ade6470d2e1ba03dfd860329
Instruction Fuzzy Hash: E3B20930A1CEC5CAF7699A28885536BB7E1FF55320F9501BFD48FC72C3D729A8828645

Function 00007DF42F5FBFCC Relevance: 2.2, Strings: 1, Instructions: 953COMMON

Download Yara Rule

Strings

I, xrefs: 00007DF42F5FC390

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: aef22b07ae88011065788565ae3b9d7e4bc705973e5c6b909056d1fa0943d643
Instruction ID: 7eb9832811b4ddf07029cd417b53e9bee5be3650b18b319a189904f1b184c81a
Opcode Fuzzy Hash: aef22b07ae88011065788565ae3b9d7e4bc705973e5c6b909056d1fa0943d643
Instruction Fuzzy Hash: 54726170A18680CFEB59CF18C4C596233E1EF5972076512FADC8BCB24BD664EC82CB91

Function 00007DF42F5A6C60 Relevance: 2.0, APIs: 1, Instructions: 543COMMON

Download Yara Rule

APIs

__swprintf_l.LIBCMT ref: 00007DF42F5A6ECD

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: __swprintf_l
String ID:
API String ID: 1488884202-0
Opcode ID: 63f1ee8d25656a3e00d0d6955f1117d7fb196370e267fea188bf0c5087272c8e
Instruction ID: 1e40ac5a3c0ed694e29a92b1750106f87e74f5440f4506b50b1b8ed8ece2f302
Opcode Fuzzy Hash: 63f1ee8d25656a3e00d0d6955f1117d7fb196370e267fea188bf0c5087272c8e
Instruction Fuzzy Hash: A7F17530B1DACD8BFB65AA58985576772E1FF54320F84017ED55FC3283DA28EC924B81

Function 00007DF42F55D594 Relevance: 1.8, Strings: 1, Instructions: 500COMMON

Download Yara Rule

Strings

X, xrefs: 00007DF42F55DA81

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID: X
API String ID: 0-3081909835
Opcode ID: 47e2a14a82faf4af34442f3675f2896fbd1bea38bf9ad006d8ec492563f1f197
Instruction ID: dd6d0ef3e59037b33eeba48f991476d1f83aff28a00808f30d25313924daaa99
Opcode Fuzzy Hash: 47e2a14a82faf4af34442f3675f2896fbd1bea38bf9ad006d8ec492563f1f197
Instruction Fuzzy Hash: 1F025170B18A869BE768DB28C8857A6B3E1FF54360F50423ED45FC3687DB78B4918781

Function 000001C4B3002C3C Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

>, xrefs: 000001C4B3002E8F

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: f32f149a88f98bc5f17b2f227718f2223b16bbf6d22f2877085ee1207e519b35
Instruction ID: 06db22a76180eed29a8242e4819445351640c8832a3e677632b8cf3155a500f9
Opcode Fuzzy Hash: f32f149a88f98bc5f17b2f227718f2223b16bbf6d22f2877085ee1207e519b35
Instruction Fuzzy Hash: 4EA11971F006099FDB44CF9AC8909AEBBF2FF8C350B14822DD919E7345D670AA46CB94

Function 00007DF42F5443F8 Relevance: 1.0, Instructions: 951COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 64da8d3960a7044e7d4f1e716a03904450145fe7d8bbf8196e21257c3c9f3f56
Instruction ID: 3d8765ac5160d4d786029a4bf62c8e952cd7fb8fed4beecb66a8a4e3e96bcd47
Opcode Fuzzy Hash: 64da8d3960a7044e7d4f1e716a03904450145fe7d8bbf8196e21257c3c9f3f56
Instruction Fuzzy Hash: F4624131A1CBD88AE765EF1898556EB77E1FF98310F40463ED48FC3152DE38A5858782

Function 00007DF42F5DEBE4 Relevance: .9, Instructions: 932COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d198448d0a17817e2fa49365b1cd9c1bc8bc84efaecc7d428f6b39a9df642da2
Instruction ID: 49abef2ad1ffe7e7fe54c6e2ab3cae3b2a61b8c8036df11ba335f56cec652d40
Opcode Fuzzy Hash: d198448d0a17817e2fa49365b1cd9c1bc8bc84efaecc7d428f6b39a9df642da2
Instruction Fuzzy Hash: 2152EA3061DEC98FE719DB2C88456A6B7E1EF64310F9882BED48FC7243D928E586C751

Function 00007DF42F513C6C Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a74110e123c44417a710d9ae179472259c10c553f0141a4cb7d2cc971c91e57
Instruction ID: 5ca678a90e9590004696b865977844dc8af8500b42ef9674a4b6110ac166c3c7
Opcode Fuzzy Hash: 1a74110e123c44417a710d9ae179472259c10c553f0141a4cb7d2cc971c91e57
Instruction Fuzzy Hash: 1D526E3160CB888FEB64EF58D885B9B77E1FF94310F40452ED48EC7256DA74A885CB82

Function 00007DF42F5DA3D4 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41df2b5529bae25ad0c5e452f2c192981c26db475fd98feb3b500a37420d33ed
Instruction ID: d0cf4e714c663a5d50ebe0744a5cb0f4ee3aa5efbd8a43f6ffa65d3d0a15c989
Opcode Fuzzy Hash: 41df2b5529bae25ad0c5e452f2c192981c26db475fd98feb3b500a37420d33ed
Instruction Fuzzy Hash: 5842973061DA888FEB59EF18C885BA673E1FF55310F54427AE44ECB147DA24E8C5C792

Function 00007DF42F501058 Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebeeddbbd667574829584fb1302eb77492d3ca514221664a9dbcb2b34e4728c2
Instruction ID: 93d399b2e1add83146efafd5bdf417482399490baf1a2c48eacf6818b5739d6f
Opcode Fuzzy Hash: ebeeddbbd667574829584fb1302eb77492d3ca514221664a9dbcb2b34e4728c2
Instruction Fuzzy Hash: 71222720A0C6D58AF72C8D2888953F23BE1EF1A720FB8117ECDDB875D3D11CA4878656

Function 000001C4B3004A38 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7508843e0d615cd037e1ec8aa7846b8b8c4448116137d463d462d581942205d
Instruction ID: cc7282281320847305aea082bbfa6a477f27fd03984e8e7ce50d7b48bc6d3252
Opcode Fuzzy Hash: f7508843e0d615cd037e1ec8aa7846b8b8c4448116137d463d462d581942205d
Instruction Fuzzy Hash: AC12C3207ACC1807FB0D563D99AA7B832D2EB8570AF34522DDEC7C15DAEC24D95349CA

Function 00007DF42F505C24 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7508843e0d615cd037e1ec8aa7846b8b8c4448116137d463d462d581942205d
Instruction ID: 507cea2960a2616dfbd48dd07c0b1cbb1f992248fb299aff8aed9b34da617853
Opcode Fuzzy Hash: f7508843e0d615cd037e1ec8aa7846b8b8c4448116137d463d462d581942205d
Instruction Fuzzy Hash: 28123910B5C8A586FB0D492C9D9A27932D2EFC9326F74513EDDCBC12C7E81CA59349C5

Function 00007DF42F59E24C Relevance: .7, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee31a9402cbbd824ccaefbd3dd2829cfa3544ca0ad2c386178c107a10df957ee
Instruction ID: 93f4d9e40ae4c3f9cc4ea5fb4c1b629731d45e608526a28ac407288214012d87
Opcode Fuzzy Hash: ee31a9402cbbd824ccaefbd3dd2829cfa3544ca0ad2c386178c107a10df957ee
Instruction Fuzzy Hash: DC324030B1C6C5CBF768DB54C95166A73E1FF88364F94053ED48FC3682DA28F8828696

Function 00007DF42F5E8474 Relevance: .7, Instructions: 703COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bacad1ff57bde7d8d07bba23db8ec1ee0ffcc5ccb224d5a1f45c0b5c0ac1baac
Instruction ID: ac9805ceafb5bb58f680d959d22926979fcab891f920aa26aaa2e26ba910ac90
Opcode Fuzzy Hash: bacad1ff57bde7d8d07bba23db8ec1ee0ffcc5ccb224d5a1f45c0b5c0ac1baac
Instruction Fuzzy Hash: 13224470B1CB888BF764DB589855B9B72E5EF94311F90063ED44EC3183EA78E985C782

Function 00007DF42F559B70 Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910ec6dba6872c6323716b983faa7859ac3cf7c6677aabaf295fb0aeb8bfc651
Instruction ID: 7f73b0f8fa789f95e87931c1b7e60be78e80e5e5465f9738b25c75e00a3ecd75
Opcode Fuzzy Hash: 910ec6dba6872c6323716b983faa7859ac3cf7c6677aabaf295fb0aeb8bfc651
Instruction Fuzzy Hash: 83129830B1CB898FE658EA288C9576A73E5FF94750F90413ED85FC3192D768F8468782

Function 00007DF42F5E3D84 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e55aeddaa24ceaf5958b2795057515a041221a7af71f25a11f1bffcd3699b22
Instruction ID: 267b6fa86795b65f41bb5a210a1021b5a7a1639be0d28f78aac3e40e887f30cc
Opcode Fuzzy Hash: 7e55aeddaa24ceaf5958b2795057515a041221a7af71f25a11f1bffcd3699b22
Instruction Fuzzy Hash: 77123135B1CAC48AE755E614C9818EBB3E1FFA4354F944A3BE08BC2193ED78E5C5C681

Function 00007DF42F539F4C Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582acf86785952c841adb130fc41005221cbec76c0ea6290688e483d94b43565
Instruction ID: 6d2543d25adb5d603cd061da53eb7cbcac1b8cfe0ac9f77ee41e44ae49b8f284
Opcode Fuzzy Hash: 582acf86785952c841adb130fc41005221cbec76c0ea6290688e483d94b43565
Instruction Fuzzy Hash: 5502333171CA888BE755EB18D855A9BB7E1FF98310F80453EE44FC3196DE34E9858B82

Function 00007DF42F5FCB04 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5303722dc3b075ed5dba5cbb5c1a5dd9dfbcb2001864c2ce16a1d73323b477e2
Instruction ID: 154383602c8de492c13b38ca39cb7b86d6b1cb40d150306aab516292e3f2ecdd
Opcode Fuzzy Hash: 5303722dc3b075ed5dba5cbb5c1a5dd9dfbcb2001864c2ce16a1d73323b477e2
Instruction Fuzzy Hash: E4E12631B18AC08BE70D9A2CCC592797BE1EF96324F6843BDE4DBC3283D56995478741

Function 000001C4B3001BA6 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1625d9a8590ad0f4ae36689fb7291813456260de861201339ce924907dd26da0
Instruction ID: 2fca779469497a5dbbb73ee88f5f549d63b5d604c1c3ad33a9249359b1bf09f0
Opcode Fuzzy Hash: 1625d9a8590ad0f4ae36689fb7291813456260de861201339ce924907dd26da0
Instruction Fuzzy Hash: 85228F31904528DFEB09CF29C4A4BEC7BB1EF54755F20856AED2A9B285D770DE80CB80

Function 00007DF42F579AE0 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7dd5877f78ba849d118ad25f272dd805b23e00e52904d729d3c24e6eae34be4
Instruction ID: 7dc09988bdbd2632ebbe8754592eb1a23d548fd08f2787edfa677a130b68b289
Opcode Fuzzy Hash: e7dd5877f78ba849d118ad25f272dd805b23e00e52904d729d3c24e6eae34be4
Instruction Fuzzy Hash: 01E11B2271C9DC8AF75D092C8C952B537A1EF5A320F6942BED48FC72C3D41CA58B866D

Function 00007DF42F5CA168 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d0e9a327c5c153424775ca9ca060451981b9c06427146ee19af952471298cb
Instruction ID: 6de88ff55d6bda8815c6c6dd5c6960d83c9b519e4ef3c441a8995c62838620fc
Opcode Fuzzy Hash: 71d0e9a327c5c153424775ca9ca060451981b9c06427146ee19af952471298cb
Instruction Fuzzy Hash: EEF19120F1C6C5CAF62D89688DB527A3AE1EF51B25FA4513AF48BC5097F61DE8C38141

Function 00007DF42F51FB24 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c118182796b8e2cd96d602acfe5b55e65f5204b244372509fab07c5fc49b7a56
Instruction ID: ebbb615537a8faccb4537f6986c06cccb8f4480f710a108fd7cfc93bdbed70fa
Opcode Fuzzy Hash: c118182796b8e2cd96d602acfe5b55e65f5204b244372509fab07c5fc49b7a56
Instruction Fuzzy Hash: B6D1B63061CFC88BE715EB6898859ABB7E1EFD5314F84063EE48AC3193D964E585C783

Function 00007DF42F50F624 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd84f1d55768a2da13bc914061cf1d895beccbb4fbb8d57f34ccda2a4f6a283
Instruction ID: bb5ec3f913ff1bac63ae0fb83ab1136d441164ba226d882195d0d2894fd26459
Opcode Fuzzy Hash: 1dd84f1d55768a2da13bc914061cf1d895beccbb4fbb8d57f34ccda2a4f6a283
Instruction Fuzzy Hash: 2EC135147289AC4AE31D8D7D6C99039B7D5EA86347724433EFEE7C20C3D85CD19396A4

Function 00007DF42F5696E0 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244705633e59c26dbd0df299ff8c8b7b035ad9e7d7ceae49d5936f1b2227a79b
Instruction ID: 845d9f0f3451142d697b4fea3b12b46485a8182e3d1f868f45d3d53ea48aa3f5
Opcode Fuzzy Hash: 244705633e59c26dbd0df299ff8c8b7b035ad9e7d7ceae49d5936f1b2227a79b
Instruction Fuzzy Hash: 12E190341286594BD31ECF5EA9814B5B7E0FA68701B50872DF9D7D3A43CA2CE027DBA1

Function 00007DF42F55A430 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e95eecd02ccd6cc44f3113866d1ecced0a7038c68817f8771a70893946283e9
Instruction ID: 0bd29a9a378dc69102254693f738138e4fd4458345b640bc5d3981cd4f9730c1
Opcode Fuzzy Hash: 5e95eecd02ccd6cc44f3113866d1ecced0a7038c68817f8771a70893946283e9
Instruction Fuzzy Hash: FBE15130708A49CFE759DE29C884BA1B3E0FF58310F55427AE55ECB262D734B896CB81

Function 00007DF42F5720BC Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a7582bf96481843b4cb98f1e16f5e5b08841e522f42b3022b188aa4a7ae8a9
Instruction ID: b945a940706c53b597ecee7124e45999cd8bb3e9193acd9948ef99ac6a201dae
Opcode Fuzzy Hash: b8a7582bf96481843b4cb98f1e16f5e5b08841e522f42b3022b188aa4a7ae8a9
Instruction Fuzzy Hash: 91C1E83491C7C09FE7488A1D85922977BE0EF5A714F6426ADF8DAC3343D128E44B8B93

Function 00007DF42F569B38 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72c8c26b592a776faf90cb3c89e7415979d55888978ffe532ce2089ea4ad658
Instruction ID: e7ebd7c17cb62567cd9f1ec1492414c8b8122c9573d9c32fbcbb7d477fca8723
Opcode Fuzzy Hash: a72c8c26b592a776faf90cb3c89e7415979d55888978ffe532ce2089ea4ad658
Instruction Fuzzy Hash: 78D1AB305186888FD31DCE5EA980466B7E0FFA9705764C62DE8DBD7A43C53CA423DB62

Function 00007DF42F5F6DAC Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2db8043be3703c0fcf183ab5b69618bf804fce31369da18694539f406ddccce
Instruction ID: 817b277887b3d77a797c595e13cb21e3e1654d7008e9b8cc2c8476b04c5c454f
Opcode Fuzzy Hash: d2db8043be3703c0fcf183ab5b69618bf804fce31369da18694539f406ddccce
Instruction Fuzzy Hash: C691FB31768D480B972C996D9C9B071B7D5D6DE213708827FFCDAC33A2E868D98386C5

Function 00007DF42F56DC54 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c5431c885f93cb748e108ccdc83bcadb03cc458c8546af8e1455d04c80a110
Instruction ID: 82432294b5578eb4e78bb7c991e4b4b733310aabae96c46935f37f1ac5b36178
Opcode Fuzzy Hash: 83c5431c885f93cb748e108ccdc83bcadb03cc458c8546af8e1455d04c80a110
Instruction Fuzzy Hash: 3BB19571A1CB888FE764EF18D84569BB7E1FF98350F50493EE49EC3251DA34E8818782

Function 00007DF42F55B104 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6300fb348d49a47f7ce5e25661db4a1277b3c7de01d4304b532d2da97ee81cb4
Instruction ID: 8cfdb0e69147111d80c0b79c0e4c7cffbdedd54f2f2c81e762240d7072bdab01
Opcode Fuzzy Hash: 6300fb348d49a47f7ce5e25661db4a1277b3c7de01d4304b532d2da97ee81cb4
Instruction Fuzzy Hash: D4C19170608E94DFEB98DF18C8896A577E0FF49710F50427AE84FCB686C734B8918B91

Function 00007DF42F54FA94 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a13153789be2d7458dee9b7317990b4201484cc000354dac11d8218a1607e752
Instruction ID: 4dfd13e4c2d944306714597fc0c227f2ebff8a03da498a77f1b5adb7c567326f
Opcode Fuzzy Hash: a13153789be2d7458dee9b7317990b4201484cc000354dac11d8218a1607e752
Instruction Fuzzy Hash: DAA17F727686448BD35CDE1CDC826A6B3D5FB8A319F14457DE4CBC3242DA34E8478A86

Function 00007DF42F5575E4 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf084cc126a23d2cc65666c9a13c8dfb48d4d3cf8bd12a9d4d0f3d1f59c4c43a
Instruction ID: 3ee3d47f7975bccfe8fb1cc2dff2d70bf93db321f3adf77dfccaa80612272c07
Opcode Fuzzy Hash: cf084cc126a23d2cc65666c9a13c8dfb48d4d3cf8bd12a9d4d0f3d1f59c4c43a
Instruction Fuzzy Hash: 8D91C12023891947E72E9D2EE88563233D4E79531AF90862DFDC3C728AC93CF45396D5

Function 000001C4B3005E7C Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99bf12b6d57f0390fbae0736817bd5c495b9b1b370792909af4a5321b831325
Instruction ID: 23eeea099a4daef4ef4f508006ccf9179a40121e4287ad3edf9163d4aa06076d
Opcode Fuzzy Hash: b99bf12b6d57f0390fbae0736817bd5c495b9b1b370792909af4a5321b831325
Instruction Fuzzy Hash: D0A1A0726183448BC75CCE1CDC826A6B3E1FB89714F14452EE8DBC7306EA34E9178B86

Function 00007DF42F52996C Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9438db2009965a8e12296e71ea6b71580e6af84f35b3edec0c28d4f2d4f26d0c
Instruction ID: de3570a40e9103070c03d77d9a484480eed0f797870f340520ad06d0e09875b2
Opcode Fuzzy Hash: 9438db2009965a8e12296e71ea6b71580e6af84f35b3edec0c28d4f2d4f26d0c
Instruction Fuzzy Hash: 42A1637061C7888FE758EF58D8959ABB3E1FF98310F40463EE48BC2256DE34E5458B82

Function 00007DF42F511E54 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c91139c534589b24547e426f0c785f7020b1bc733841a5ce54103c1d8087b07
Instruction ID: 1652e7cde46e71cbc7d3787c090917e3cba2ee8c7e3849aa5ee22f5e091c077f
Opcode Fuzzy Hash: 7c91139c534589b24547e426f0c785f7020b1bc733841a5ce54103c1d8087b07
Instruction Fuzzy Hash: A2A1A5709584D18AE31E8F299894532FFE4EF4630631582FEE4DBCA193D92CE583DE94

Function 00007DF42F55B7B8 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c96cf5b081f1c271c85b47d3070207957e50e25e112138fd6558beb8fd5823
Instruction ID: a24714fa8a81a1fb3821abbe950d2e947109818cd6a1c4337091b32ca34098fe
Opcode Fuzzy Hash: 37c96cf5b081f1c271c85b47d3070207957e50e25e112138fd6558beb8fd5823
Instruction Fuzzy Hash: C88115B1628A158B9B0CDE1DD8E117677D2FB8A301764D13ED8C7CB68BC928E407CB95

Function 00007DF42F5EFB04 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4848e00ff4ceffe7feb6f12962d7d49341b6c6292cea1c502673fcd24b7aa1a
Instruction ID: 8cdf5798a0765effbf146c9a1f104a7fd5477ac131d9e19f85503a47f9d060bb
Opcode Fuzzy Hash: a4848e00ff4ceffe7feb6f12962d7d49341b6c6292cea1c502673fcd24b7aa1a
Instruction Fuzzy Hash: 8F816321F0C7D986FBB89968684136B72E5DF94320FA5453FDC4FC2187EE78E8818681

Function 00007DF42F54F3B8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5f0ae776f6ad78f1aba07c9dfb1ff23e8d92438ec16d930776bfb79c1a1d1f
Instruction ID: f93129f434e3cebfd6c4450245cb63f486d5e051a2c05b365e69a370ad982b57
Opcode Fuzzy Hash: 2e5f0ae776f6ad78f1aba07c9dfb1ff23e8d92438ec16d930776bfb79c1a1d1f
Instruction Fuzzy Hash: 94A1732121D7D44AD70A9F7C88514ABBFE0DF9A224F884AAEF8CA9B143C814D706C757

Function 00007DF42F54F02C Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b865d7c93b2712d13a2f4ba1d7773eea38583b68b12a7069d4f7e3f29bb2cab
Instruction ID: 24728a1a22341bbfffd374570f318f87db55345c67d363dcf23d7f7690183f19
Opcode Fuzzy Hash: 8b865d7c93b2712d13a2f4ba1d7773eea38583b68b12a7069d4f7e3f29bb2cab
Instruction Fuzzy Hash: 52815751E4A5D0AAFD19B63049321DB5BF14F273A0BA9A476A0EE8B743CC0DB08DC7D4

Function 000001C4B30058FC Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1827aaf7f97979e9ab29b59ba022659b9ef4d45ee2af9165a436c74404936888
Instruction ID: f5a6884ba0884ca781176996e14edf00ae846f862d824a57699ccbd5d788562e
Opcode Fuzzy Hash: 1827aaf7f97979e9ab29b59ba022659b9ef4d45ee2af9165a436c74404936888
Instruction Fuzzy Hash: 6E91522121D7C80BD70AAB7D84516EBBFE0EF9A218F484B9DE8C9AB147C814DB05C757

Function 000001C4B300557C Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ccd6fa622a76a818935e2f1fa1ef10ca9fe37c8e962ab94c2110c9af2e6f40
Instruction ID: 56441227228ff097ff260c1b3740129f1915e3aebd5a98ba0aa2c60af3c0b6f9
Opcode Fuzzy Hash: 45ccd6fa622a76a818935e2f1fa1ef10ca9fe37c8e962ab94c2110c9af2e6f40
Instruction Fuzzy Hash: 86911E71688EA613FA0A77F200757E9BBEA4F46709F0548AC68F6873C7ED18CC09565C

Function 00007DF42F5F72C8 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2850bd5198a9b816de81955e46142d69e3a7ee114508054ebd4e80cd7218991e
Instruction ID: 04b839bc0a14ea63598ed30b47a7d12e867f8ac5da08cab383d14eaf11bb8812
Opcode Fuzzy Hash: 2850bd5198a9b816de81955e46142d69e3a7ee114508054ebd4e80cd7218991e
Instruction Fuzzy Hash: B451D12132DE4D4BA31C95ADAC8A471F7D0EB69201354837EE8DBC3A53E914F857C2DA

Function 000001C4B30024F7 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fa3e758852d134936ebae0b560bbe3bce86139278003640ae1b14167d74dbd
Instruction ID: e966a966e649a3515ebd3e081e667761898af9f374a85c2bff7026a253b08380
Opcode Fuzzy Hash: 29fa3e758852d134936ebae0b560bbe3bce86139278003640ae1b14167d74dbd
Instruction Fuzzy Hash: 1B81C0D0ECDAD566F95137F2543AFEB6BAC0F1A704F489C4578E892887CC38D9448A35

Function 00007DF42F5EAF80 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a52acd7e6bdfa72c397d96fa81eea2473487bd4bd84088080e3978d7766b9f3
Instruction ID: a7fbe49e809df0ab2a123cefd715ace82bc921df0137c54fb9828ce0c129045d
Opcode Fuzzy Hash: 1a52acd7e6bdfa72c397d96fa81eea2473487bd4bd84088080e3978d7766b9f3
Instruction Fuzzy Hash: EB61B831A1CECC4AFB69AE289C45BEA77E0EF54321F80017ED84FC6183D974A585C782

Function 00007DF42F51F95C Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f5d20fd88ee3c57571dd0175cdde158d54a14104b118c336fd0e8495a79fda
Instruction ID: b521d3058b2e1e0f03f0d6cb6e547770701238700b43d1542f4b03505b58c022
Opcode Fuzzy Hash: a5f5d20fd88ee3c57571dd0175cdde158d54a14104b118c336fd0e8495a79fda
Instruction Fuzzy Hash: 95512620329D8C4BE70D9A2C688957577D1E7A9351F5882BFFC8ACF2C3C815D496C3A6

Function 00007DF42F530F04 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a1c7c723d25296df9d634e3286c20792222784fdaab10063b8db0c4ac8506b
Instruction ID: 692b064581a83d3992c017ce5e2357d1d767d28095362cd9ab3cd2e59c0a5472
Opcode Fuzzy Hash: 93a1c7c723d25296df9d634e3286c20792222784fdaab10063b8db0c4ac8506b
Instruction Fuzzy Hash: 22816421F0C6C1C6FA749B795C521BB76B1AF51374FC0453BD84B869D3EAA878C28781

Function 00007DF42F5EAE00 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfd4daa1486a0bf67fc2b4eb8506a8b91b6f4513f73aba7ae0fb8ecb8c87f15
Instruction ID: aca3fcb00d3a996f7e3bdc03482e072d1f6b74dbdda070e0e90f382364244554
Opcode Fuzzy Hash: bcfd4daa1486a0bf67fc2b4eb8506a8b91b6f4513f73aba7ae0fb8ecb8c87f15
Instruction Fuzzy Hash: D041C91032ED894BE30D856D684993077D1E7A939577882BFF88DCB2C3C816D59BC3A9

Function 00007DF42F5693F4 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0174ded671116168eeb666caa0351c18c6562f1c7d91879c02c27937d12039b
Instruction ID: d1361764a71efee2d2bfaaf5b321b7a60d13e5319a6646832c04e37a13ca3d96
Opcode Fuzzy Hash: c0174ded671116168eeb666caa0351c18c6562f1c7d91879c02c27937d12039b
Instruction Fuzzy Hash: 6A612630A0C9C48AF3189F6498610BB7BF1FFA9364F9505BED5EB87183D519E182C742

Function 00007DF42F5EA4A0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97639a4261f7d2abeacf014d93b0736467758bf5a6c6ac16e29624481be8cb39
Instruction ID: 2731b24ac43a9603a5f86477af63fe62f11a9993246da61f80a2bdb05e531ec9
Opcode Fuzzy Hash: 97639a4261f7d2abeacf014d93b0736467758bf5a6c6ac16e29624481be8cb39
Instruction Fuzzy Hash: EF51D53151CAD94FDB1D9F3848540A1BFE1FB57310B4892EED8CACB247D926A887C391

Function 00007DF42F5EB318 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b9c61aa926829bf701696f2ce4216978562559d3dcc951bccc065de6802ad6
Instruction ID: d855ab4eb5418a25b22c74b1462cad2e03949f28c0af807443c5324698368974
Opcode Fuzzy Hash: 69b9c61aa926829bf701696f2ce4216978562559d3dcc951bccc065de6802ad6
Instruction Fuzzy Hash: DB41C32031DECC4BE348A66C684549A7BD1DB99394F84466FF88DD7283C824DAC6C3E7

Function 00007DF42F5E9F68 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75586f971ab0ec2908ec42ae2db8c9d4d6f5efb4d73e4442684b2c9eb032660f
Instruction ID: 7663ffb063680533278552fb91bb34bcbab6f8743c03c0b38aff2607721e83b1
Opcode Fuzzy Hash: 75586f971ab0ec2908ec42ae2db8c9d4d6f5efb4d73e4442684b2c9eb032660f
Instruction Fuzzy Hash: F081AAB1A112069FD7C4CF29C580A51F7E0FF5C2687A5A6A9D008CE602E335EAD6CF84

Function 00007DF42F5EA8BC Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438f6406dd8b5d38ec6f9270147976f9b0cff49bb77c05463844d53043ea589d
Instruction ID: cfe34f5cf834ad13d2df3dcc3ff57d1b7bca7b2085f884732108a540895b437c
Opcode Fuzzy Hash: 438f6406dd8b5d38ec6f9270147976f9b0cff49bb77c05463844d53043ea589d
Instruction Fuzzy Hash: A541862071CACC8BE749D62C4844A5B7AE0DFA9254F8446BFF88EEB283C564D5C5C366

Function 00007DF42F54FDE0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fceb8ee2881daf23b8f4d311f0160945a1273895919ebfa7c7f9807d66ed711
Instruction ID: f27bd74f950adfa79582b4cb0e16cb67879ca820f7e79eff9361f031b7340075
Opcode Fuzzy Hash: 0fceb8ee2881daf23b8f4d311f0160945a1273895919ebfa7c7f9807d66ed711
Instruction Fuzzy Hash: F541B930729AC98FEB49DB3C48C455577E1EF9921178442BAEC4ACB287C954E9C5C3D1

Function 00007DF42F552524 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dc57685899ca33b0221605e943405ad384610858e7a6476cdee2065fe759d5
Instruction ID: e26917d1381a1452521190459783394e10c460179554512acfee9880439a2d61
Opcode Fuzzy Hash: 76dc57685899ca33b0221605e943405ad384610858e7a6476cdee2065fe759d5
Instruction Fuzzy Hash: 10417B1521DAC59EC70ACF6C4490495BFB0EEAA100B0C83EEE8D9DB747C104E65AC7B6

Function 00007DF42F5E69A8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96d54304f3975fead233839aff55c3910687aa7be08d9657a0ce49fff377c55
Instruction ID: 554f8fcf126cb1b76c82abd7ff131c237da8efb13fc7a62beb097ad50284a167
Opcode Fuzzy Hash: e96d54304f3975fead233839aff55c3910687aa7be08d9657a0ce49fff377c55
Instruction Fuzzy Hash: C331C432734C4D4BAB4CD93CDC4AA3133D5EB9931A718927EE887C71E6E939D8838645

Function 00007DF42F5695D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a630f0d11370fefec7d6f0a9329444f853f8d3045f37a3f58e66565daf0adbae
Instruction ID: 0bd302d3264722b704907422adeefe20781607092224939ccff5d32cff365097
Opcode Fuzzy Hash: a630f0d11370fefec7d6f0a9329444f853f8d3045f37a3f58e66565daf0adbae
Instruction Fuzzy Hash: B731F42100C4D04BC72FDE6EA9E8435BBF2FF5530976480CEE5D39A04BD92F91239A59

Function 00007DF42F55CA38 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22ce57ede86ec268f1720e0e62678790644e15932bad12b6d5ec8559cb04c17
Instruction ID: 9e7f15a240b4f417907b7403f7bf7ff6949c34716448f1e962125d1314d9d51c
Opcode Fuzzy Hash: b22ce57ede86ec268f1720e0e62678790644e15932bad12b6d5ec8559cb04c17
Instruction Fuzzy Hash: 3D319E30704942ABD34CDA29C891BE5F7E1FB88311F24823ED99FCA641C77874A6CB80

Function 000001C4B300279C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.1837835512.000001C4B3000000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B3000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_1c4b3000000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5213f45423dfc1c4daa0851ce59fe88635ccf7c1f6bfbb83ad2757af5ec886d6
Instruction ID: 9f76eda95435e07fb641da699dd7249bdb0d942602ddd2410c8396f6b119c4ec
Opcode Fuzzy Hash: 5213f45423dfc1c4daa0851ce59fe88635ccf7c1f6bfbb83ad2757af5ec886d6
Instruction Fuzzy Hash: A611E72910D2D05AC392DB3DC9D9847BFA29E9612437EC6CDC58C0F26BC1B6D94BC791

Function 00007DF42F52E261 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2089590138.00007DF42F501000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF42F501000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_7df42f501000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f5df41ea43a57528ce76f95f617c5d60ae02f95908509022172248d9e28bd8
Instruction ID: 317b8491c6c81d94af8fc2b3a06f72133790875556e8c436f9feff669d1d81d5
Opcode Fuzzy Hash: 46f5df41ea43a57528ce76f95f617c5d60ae02f95908509022172248d9e28bd8
Instruction Fuzzy Hash: FFB01130E28808C2C2280E0AF802330F2B0C30B300F00303A2000F3A20C8BACC82008F

Function 000001C4B1600511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2089949265.000001C4B1600000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001C4B1600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c4b1600000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction ID: 9c6f723353de5f7bfac1b68b00d860ec9f8fa9508ac40f659eae0282c9a534f1
Opcode Fuzzy Hash: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction Fuzzy Hash: 26B01132E28A0082E3880E0AB8023B0F2B0C30B300F00B0322008F3220C828CC08028F

Analysis Process: setup_wm.exePID: 2656, Parent PID: 2872COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	5.9%
Signature Coverage:	0%
Total number of Nodes:	237
Total number of Limit Nodes:	18

Executed Functions

Function 00007DF449D01958 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337nativememoryCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007DF449D0199B
NtAllocateVirtualMemory.NTDLL ref: 00007DF449D01A3A
NtWriteVirtualMemory.NTDLL ref: 00007DF449D01A88
NtQueryInformationProcess.NTDLL ref: 00007DF449D01AB0
NtReadVirtualMemory.NTDLL ref: 00007DF449D01AE0
NtReadVirtualMemory.NTDLL ref: 00007DF449D01B13
NtReadVirtualMemory.NTDLL ref: 00007DF449D01B42
NtReadVirtualMemory.NTDLL ref: 00007DF449D01B76
NtProtectVirtualMemory.NTDLL ref: 00007DF449D01BBD
NtProtectVirtualMemory.NTDLL ref: 00007DF449D01C44
NtWriteVirtualMemory.NTDLL ref: 00007DF449D01C69
NtProtectVirtualMemory.NTDLL ref: 00007DF449D01C8D

Strings

H, xrefs: 00007DF449D01C15
H, xrefs: 00007DF449D01BF2

Memory Dump Source

Source File: 00000010.00000003.2034334262.00007DF449D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_7df449d01000_setup_wm.jbxd

Similarity

API ID: MemoryVirtual$Read$Protect$Write$AllocateInformationProcessQuerycalloc
String ID: H$H
API String ID: 874015164-136785262
Opcode ID: 8b723a4ddad616be20f9dda8abf44bc9042e1d61a48c0cd72079f3722cd3507a
Instruction ID: 3a2d430f9e495382d195d368907270cd23f21722d135568940f10e4cf78ab269
Opcode Fuzzy Hash: 8b723a4ddad616be20f9dda8abf44bc9042e1d61a48c0cd72079f3722cd3507a
Instruction Fuzzy Hash: C9B1647060CB888FD754EF18E885B9AB7E5FBD8304F000A2EE58EC3251DB74E5458B86

Function 0000019168212D24 Relevance: 15.3, APIs: 1, Strings: 7, Instructions: 1263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000019168204998: calloc.MSVCRT ref: 00000191682049CB

RtlFormatCurrentUserKeyPath.NTDLL ref: 000001916821386B

Strings

t, xrefs: 0000019168213A60
MZ, xrefs: 0000019168213971
;$dW, xrefs: 0000019168213D1C
;$dW, xrefs: 000001916821352D
MZ, xrefs: 0000019168213583
;Ln, xrefs: 00000191682131B4
N, xrefs: 0000019168213A58

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: CurrentFormatPathUsercalloc
String ID: ;$dW$;$dW$MZ$MZ$N$t$;Ln
API String ID: 4207655178-84560671
Opcode ID: 1512b8534d4c685afcc9061355cc33150ae67fa718ee72ec55426bd84ba67b64
Instruction ID: 69b74d1d090aa943f096c2c27fa0cd940ed7e412683dd43c09c291b41b892894
Opcode Fuzzy Hash: 1512b8534d4c685afcc9061355cc33150ae67fa718ee72ec55426bd84ba67b64
Instruction Fuzzy Hash: 39A29FB4918B888FD375DF1888887DAB7E5FB99702F100A6ED98DC3251DB749581CB83

Function 00007DF449D01CE8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 296processnativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007DF449D01290: RtlAddFunctionTable.KERNEL32 ref: 00007DF449D012BD

Part of subcall function 00007DF449D012C8: VirtualProtect.KERNELBASE ref: 00007DF449D012F5

Part of subcall function 00007DF449D01438: RegOpenKeyExW.KERNELBASE ref: 00007DF449D01497
Part of subcall function 00007DF449D01438: RegQueryValueExW.KERNELBASE ref: 00007DF449D014E6
Part of subcall function 00007DF449D01438: RegCloseKey.KERNELBASE ref: 00007DF449D0150C
Part of subcall function 00007DF449D01438: GetVolumeInformationW.KERNELBASE ref: 00007DF449D01570

CreateProcessW.KERNELBASE ref: 00007DF449D01F80
NtResumeThread.NTDLL ref: 00007DF449D01FA5
CloseHandle.KERNELBASE ref: 00007DF449D01FBF
free.MSVCRT ref: 00007DF449D01FDC

Strings

-, xrefs: 00007DF449D01E95

Memory Dump Source

Source File: 00000010.00000003.2034334262.00007DF449D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_7df449d01000_setup_wm.jbxd

Similarity

API ID: Close$CreateFunctionHandleInformationOpenProcessProtectQueryResumeTableThreadValueVirtualVolumefree
String ID: -
API String ID: 3434737372-2547889144
Opcode ID: 105c85825427e7c8ed203293b96c467a96f9bba36c05be2648f83f100e5bc7da
Instruction ID: 1f6a6e55d491554330e76213832523c628053332a069e3d38f6ca957beb3f932
Opcode Fuzzy Hash: 105c85825427e7c8ed203293b96c467a96f9bba36c05be2648f83f100e5bc7da
Instruction Fuzzy Hash: 4D91E7B060CA495FEB54FF24E885AAB77E1FF98308F00452AE54BD3191DFB8E8019781

Function 000001916820CDF4 Relevance: 4.6, APIs: 3, Instructions: 110
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE ref: 000001916820CEA7
BindIoCompletionCallback.KERNEL32 ref: 000001916820CEDE
ConnectNamedPipe.KERNELBASE ref: 000001916820CEEF

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: NamedPipe$BindCallbackCompletionConnectCreate
String ID:
API String ID: 2502124517-0
Opcode ID: 1f39a579d535edce93b33f8ad890ac1eeea552d42be0d6d7d28d92d913c1a808
Instruction ID: 204a0f9fa851c53a144f2a439ea51ce9b07b7932bc5fe4f0a248c3a75f683e14
Opcode Fuzzy Hash: 1f39a579d535edce93b33f8ad890ac1eeea552d42be0d6d7d28d92d913c1a808
Instruction Fuzzy Hash: 2B319FB0608A088FE7A5EF28D898B9A77E5FB98310F50462DD45AC31D1DB74C985CB82

Function 0000019168212C64 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 0000019168212CBC

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f6b0f352e34b93935ac2a1f97fa2b0892be8d0a68ee0d9962c8f94757f801c03
Instruction ID: 02b4a228421441009004b496cd882c0028e9561d905c3d424182cf721742f330
Opcode Fuzzy Hash: f6b0f352e34b93935ac2a1f97fa2b0892be8d0a68ee0d9962c8f94757f801c03
Instruction Fuzzy Hash: EA21C3F5B049495FE750DE58C8D43A972D0E79E342F70057EFE8AC3250DAA48884C742

Function 0000019168401F40 Relevance: 3.4, APIs: 2, Instructions: 426memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 0000019168402572
VirtualFree.KERNELBASE ref: 00000191684026C4

Memory Dump Source

Source File: 00000010.00000003.2027576995.0000019168400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000191683F0000, based on PE: true

Associated: 00000010.00000003.2007435070.00000191683F0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000010.00000003.2007690893.00000191683F0000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_191683f0000_setup_wm.jbxd

Similarity

API ID: Free$HeapVirtual
String ID:
API String ID: 3783212868-0
Opcode ID: 16577e33d3ca070a1d5e41c5c5c7c11fd34e810a8e97d5c87b6d2ebc25ec2081
Instruction ID: 1f21aedb1cef750d3b7189bc6cad74e4f8b2768b32142fdfd728a2647a902d80
Opcode Fuzzy Hash: 16577e33d3ca070a1d5e41c5c5c7c11fd34e810a8e97d5c87b6d2ebc25ec2081
Instruction Fuzzy Hash: 580265B3A046A196D776CF28D0607AE7BE1F388784F448056DFAA47784DF78C986C741

Function 0000019168202628 Relevance: 3.3, APIs: 2, Instructions: 293
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 000001916820272E
SuspendThread.KERNELBASE ref: 0000019168202770

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: CloseHandleSuspendThread
String ID:
API String ID: 1038686644-0
Opcode ID: ee0b4b29cbf429cf193f7da3647d56e0b1a845656fd74a12addcfb7ee39e090b
Instruction ID: fdd027c33e43a924fa7581474c81e4a33cda08ce1e84287ce57bb58b5a0b6193
Opcode Fuzzy Hash: ee0b4b29cbf429cf193f7da3647d56e0b1a845656fd74a12addcfb7ee39e090b
Instruction Fuzzy Hash: 27912CF0A089165BDB6DDB18D8613B973D2FB49310F14419ED847C7192DA75D883CB93

Function 000001916820C25C Relevance: 1.8, APIs: 1, Instructions: 560
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001916820C65C

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1463b6e579e83794cd598155eb9e3160b38bf0e3bcb0f61670329aaf0c67c5a2
Instruction ID: af72ae2057d32cadad738210978450cd5d05b8f4cab3ca5731c5a493394d318a
Opcode Fuzzy Hash: 1463b6e579e83794cd598155eb9e3160b38bf0e3bcb0f61670329aaf0c67c5a2
Instruction Fuzzy Hash: 36F13CB0A185640FE72CDB2C98962B977D2F785701F2842AED8DBC2193D978C587C7D2

Function 00000191682129D4 Relevance: 1.8, APIs: 1, Instructions: 260
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 0000019168212A94

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: f13696e1930880e2e19ebf6412232386b6a4ab7a0f564d2111b2459b68bcc0da
Instruction ID: c8833ae1461f30b313465f2ff78d690dd84f7d877669a9812bc4389f49aa379b
Opcode Fuzzy Hash: f13696e1930880e2e19ebf6412232386b6a4ab7a0f564d2111b2459b68bcc0da
Instruction Fuzzy Hash: AB81D7F8A18B0B9BE775DB1494647AA73D0FB99302F70455DFD86C3180EAA4D981C643

Function 00000191682127B8 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 0000019168212807

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d9381645012d00cf6e7f8dfe8da443d67e907387f0873f85681973196ff3555c
Instruction ID: c1111f2f370f2484de647a655b4cad5c5450c3cf2a5f2ca7bf903449366e54c7
Opcode Fuzzy Hash: d9381645012d00cf6e7f8dfe8da443d67e907387f0873f85681973196ff3555c
Instruction Fuzzy Hash: 7FF0DA74E18B458FDB64EF2CD489B9A77E0FB99301F60455DE88CC3245DB34D8848B86

Function 0000019168212990 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00000191682129BA

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 98d03459468cdcd74854b97b597847e55f0ea75636d4913b4c299d0c762e3800
Instruction ID: 8c5e506d25d871dd5c16c3c5a346bd00cf180648cc930ad84582a14a0956700c
Opcode Fuzzy Hash: 98d03459468cdcd74854b97b597847e55f0ea75636d4913b4c299d0c762e3800
Instruction Fuzzy Hash: A9E092B5608A098FDB00DF98CCC19A9B3E4E7D9301F504D6AED8AC6164D3A4D698CA93

Function 000001916821288C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00000191682128A7

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1d483c746a178fd7cebb358bd60c8d391381be698edd62c71eedc0381d53c554
Instruction ID: ca3381ab156859ff1deb62aec98484ac8a4042c738a4a2842e2203c6a2301dfe
Opcode Fuzzy Hash: 1d483c746a178fd7cebb358bd60c8d391381be698edd62c71eedc0381d53c554
Instruction Fuzzy Hash: E2D0A7B8E28B4A4FEA10F728894030537D1F7DA309FA1464CAC88C3254E62DD44183C3

Function 00000191682128B8 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00000191682128D9

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: bd75e34d41d0a0c218f00c4b384fa59cf13494ae4b0fc6bee219bc2a66024f0a
Instruction ID: 596d525f6e266bf63e956a7d7644d3977a29ea0229bec4a5a6e9fef9a6cd0e0f
Opcode Fuzzy Hash: bd75e34d41d0a0c218f00c4b384fa59cf13494ae4b0fc6bee219bc2a66024f0a
Instruction Fuzzy Hash: EED012B8D587499BD610EB2888406097BE1FBDA315F75465CF88483314E339D481C787

Function 000001916821252C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001916821254D

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 27a0ab9b8b81d19b55a36d5b88940b5d877d47714e961321c564cf766a84aa8c
Instruction ID: 411675d2039af2e19e3e5a8627c16363b2732a654058b45dcba9995109aac524
Opcode Fuzzy Hash: 27a0ab9b8b81d19b55a36d5b88940b5d877d47714e961321c564cf766a84aa8c
Instruction Fuzzy Hash: BCD012B8E187459BD714EB2889916097BE1F7CA315F64465CFC8883310E238D481C687

Function 00000191682128E8 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,?,000001916820531B), ref: 00000191682128F8

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 14fbc5d4ea2d13eb613c5f0cfb1986910ad3174e43fd425e2ce4bb45159b65c3
Instruction ID: 0109174735b932ebe7166f12eb02bfdaabfed4dcdf2ec16fbd1e01b80bd12ad8
Opcode Fuzzy Hash: 14fbc5d4ea2d13eb613c5f0cfb1986910ad3174e43fd425e2ce4bb45159b65c3
Instruction Fuzzy Hash: ECC08CE8A18D0F2AEA00E2AD4C917482280E34E305FA00040AC45C2180E94CD5C083A7

Function 0000019168212418 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 0000019168212428

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 2134b33d09b848e70ba1f23de37cfdd97cd4e92c7083e33fbb9b34bfa8345c36
Instruction ID: 619aadef587423bc42d79b07eaa489fdf015365ed19a6d88151784f7a279849a
Opcode Fuzzy Hash: 2134b33d09b848e70ba1f23de37cfdd97cd4e92c7083e33fbb9b34bfa8345c36
Instruction Fuzzy Hash: 30C08CA8E1480B2AE915A2BA9DD07492090E78F340FD00040BD08C2180F48CC8C0839B

Function 00007DF449D01438 Relevance: 6.1, APIs: 4, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007DF449D01497
RegQueryValueExW.KERNELBASE ref: 00007DF449D014E6
RegCloseKey.KERNELBASE ref: 00007DF449D0150C
GetVolumeInformationW.KERNELBASE ref: 00007DF449D01570

Memory Dump Source

Source File: 00000010.00000003.2034334262.00007DF449D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_7df449d01000_setup_wm.jbxd

Similarity

API ID: CloseInformationOpenQueryValueVolume
String ID:
API String ID: 4069062851-0
Opcode ID: 3ebb744f0aebbecadcf06631c3d65907a1788fb7df7ced3004579ef494ef68f9
Instruction ID: 671975acf4b0e1a2bc304e2a1951497b619df4aeb520022e9921b45eb1b206bd
Opcode Fuzzy Hash: 3ebb744f0aebbecadcf06631c3d65907a1788fb7df7ced3004579ef494ef68f9
Instruction Fuzzy Hash: 0341497060CA488BE755EF24D899BDBB3F1FB94309F004A2EE58BC6191EF78D5048B42

Function 0000019168217DA0 Relevance: 6.1, APIs: 4, Instructions: 130
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0000019168217DA9
socket.WS2_32 ref: 000001916821B24B
getsockopt.WS2_32 ref: 000001916821B27F
socket.WS2_32 ref: 000001916821B2B4

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: socket$ErrorModegetsockopt
String ID:
API String ID: 552242919-0
Opcode ID: 3bad8950bc8ed42d49e75fcab8a12e6def80f6fb96da2e8da31b13afe45452c3
Instruction ID: 35342b8c789794a817ba0bc1467de9f946d860fc5d216aac6e3e3c58cfc2bdc3
Opcode Fuzzy Hash: 3bad8950bc8ed42d49e75fcab8a12e6def80f6fb96da2e8da31b13afe45452c3
Instruction Fuzzy Hash: 8541D670A08B498FE759EF28D8986AA77E1FB98300F50467DE44BC33A1DF788455CB42

Function 000001916820DFC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001916820E047
VirtualProtect.KERNELBASE ref: 000001916820E070

Strings

rE\, xrefs: 000001916820DFDC

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: fd197d1d460a7a7097ebc69198cfe8898b84731961e3c45740b5833891c72836
Instruction ID: 11d9fb6a37c43748b57d0dd4d30e0291146648dea667fa1beeebc035445c6a7f
Opcode Fuzzy Hash: fd197d1d460a7a7097ebc69198cfe8898b84731961e3c45740b5833891c72836
Instruction Fuzzy Hash: 6611C4B17049091FEB45FB1898E5BE972E7F7D8300F50056DA84BC3286EE68DD86C742

Function 000001916820BBF0 Relevance: 4.6, APIs: 3, Instructions: 110
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingW.KERNELBASE ref: 000001916820BC4C
MapViewOfFile.KERNELBASE ref: 000001916820BC6E
CloseHandle.KERNELBASE ref: 000001916820BCE6

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: File$CloseHandleMappingOpenView
String ID:
API String ID: 2553196624-0
Opcode ID: 8bb8605ac1c349b7ed951fd2da0efd1c73228fe5391c7a5f19e2fcd3618d3200
Instruction ID: 1b3b23929ac186a6b67f960e9a8f0e971e541e4457f442c6ba9bcdeee0944f42
Opcode Fuzzy Hash: 8bb8605ac1c349b7ed951fd2da0efd1c73228fe5391c7a5f19e2fcd3618d3200
Instruction Fuzzy Hash: ED31C475A149089FDB54FF20D8966EAB3D5FB94301F50496EAC4BC3181DE70D549C783

Function 000001916820B9D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 000001916820BB1F

Strings

P, xrefs: 000001916820BA46

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: CreateWindow
String ID: P
API String ID: 716092398-3110715001
Opcode ID: 3958d680dd61ed40200acf61cd907bfc270c34c5250da5fbb8d7e78c828db693
Instruction ID: 88a886e50e3f3aa1aa4c5aab788c291f41356bd5a959811822c71e85e1ac44ef
Opcode Fuzzy Hash: 3958d680dd61ed40200acf61cd907bfc270c34c5250da5fbb8d7e78c828db693
Instruction Fuzzy Hash: 10515FB0518B448FD7A5EF28E89679AB7E5FB99301F10462FE48EC2150DF349585CB83

Function 00000191682022D0 Relevance: 3.2, APIs: 2, Instructions: 222
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00000191682022E8
VirtualAlloc.KERNELBASE ref: 00000191682023B4

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 9420d4d47bb5eb7f06d7fea4bf54311970c83033f74d5905fb72208c54926d5e
Instruction ID: e4c0d4956189e5e57f68f9b64942c2fb8abd14fd21bd6618080c10d8acd4dd7c
Opcode Fuzzy Hash: 9420d4d47bb5eb7f06d7fea4bf54311970c83033f74d5905fb72208c54926d5e
Instruction Fuzzy Hash: 1751D9B0A18E0E4FE756EB6C94583A972D2F79C301F5441AEDC49C7195EAB4C8C2C783

Function 000001916820D594 Relevance: 3.1, APIs: 2, Instructions: 132
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 000001916820D5D8
CloseHandle.KERNELBASE ref: 000001916820D62C

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: CloseFileHandleView
String ID:
API String ID: 3964672402-0
Opcode ID: f5e4ace49f8dbf4d208ab68c6c07d1c08f373a7b01313fe5be4b999b6ef0fbb6
Instruction ID: 1f5cd89feef40b7ae17f1d712ebf31e60c5af659cb871ffa7a61fad6c4a32f25
Opcode Fuzzy Hash: f5e4ace49f8dbf4d208ab68c6c07d1c08f373a7b01313fe5be4b999b6ef0fbb6
Instruction Fuzzy Hash: 6A41E6B0A059095FE745FF68E8A4BEA73E6FB95301F00425DA80AC3191DF74D882CB82

Function 0000019168202974 Relevance: 3.1, APIs: 2, Instructions: 97
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000191682029B3
VirtualProtect.KERNELBASE ref: 0000019168202A19

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9af94119fb7637b7a971dd9e5dfe6689dbe62cc4b897151fb24c5dcbfab40a36
Instruction ID: 6bc7ad65e17fc4205826b76142d743249b7ebcab6e0c7ab9c4b86a0093d9578f
Opcode Fuzzy Hash: 9af94119fb7637b7a971dd9e5dfe6689dbe62cc4b897151fb24c5dcbfab40a36
Instruction Fuzzy Hash: EE312BB070CA864BEB159B6C98A47953BC5FB5E314F1502D9EC89C72C6DB98C843C396

Function 00007DF449D012C8 Relevance: 3.1, APIs: 2, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF449D012F5
VirtualProtect.KERNELBASE ref: 00007DF449D0137E

Memory Dump Source

Source File: 00000010.00000003.2034334262.00007DF449D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_7df449d01000_setup_wm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 89563af4fe1d572c43706a2c5b782feb3df9d02bfd1ff06021ce1d81ad062eb6
Instruction ID: bc63a2bac60b3b22dfeae7684e2a8644fffd3cb4d0608f4ba9878e6d7c63a4b0
Opcode Fuzzy Hash: 89563af4fe1d572c43706a2c5b782feb3df9d02bfd1ff06021ce1d81ad062eb6
Instruction Fuzzy Hash: 0C2105B160864557DB18AFACE440A76B3F1FF9830CF14413AE84BD7A85D6A8F8019244

Function 00007DF449D11D6C Relevance: 3.1, APIs: 2, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007DF449D11D99
VirtualProtect.KERNELBASE ref: 00007DF449D11E22

Memory Dump Source

Source File: 00000010.00000002.2949847955.00007DF449D11000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7df449d11000_setup_wm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 53d1f5fc2553b1aed198646ddb2b775e91b1462906af7418210f7ec683df6e8f
Instruction ID: 10ef3265449b5de04eed1d5a53ff4e08b9a1969f9f662d504b6960bcb0fc492f
Opcode Fuzzy Hash: 53d1f5fc2553b1aed198646ddb2b775e91b1462906af7418210f7ec683df6e8f
Instruction Fuzzy Hash: D72124B260854547EB28AB68D896E72B3F1FF88305F14053BE44FD7286D7B8E9029345

Function 000001916820CA8C Relevance: 1.7, APIs: 1, Instructions: 228
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 000001916820CC99

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e26a3d902f64fdb1e6a29b1ddfd8af137ced715061d327bbcfc87f3b72d7e64f
Instruction ID: be4177ff8d17917d46e279091fd887f41c4c9ff1b8b0f3cee58cf394a6174b02
Opcode Fuzzy Hash: e26a3d902f64fdb1e6a29b1ddfd8af137ced715061d327bbcfc87f3b72d7e64f
Instruction Fuzzy Hash: 7871E9F1608B095FD769EB18D891AA973E2FB94B10F10065DDD8BC3192DB70E987C782

Function 00007DF449D015E8 Relevance: 1.7, APIs: 1, Instructions: 228COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE ref: 00007DF449D0172D

Memory Dump Source

Source File: 00000010.00000003.2034334262.00007DF449D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_7df449d01000_setup_wm.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: a4d7378eb0dc183d45dac9fde789c38604b4b9a60361aa9a1ccba498305d516d
Instruction ID: e38ace8971b5d1d84f05f8d256662577093ec44a1fd8b7ca86eea96812247f1b
Opcode Fuzzy Hash: a4d7378eb0dc183d45dac9fde789c38604b4b9a60361aa9a1ccba498305d516d
Instruction Fuzzy Hash: B371837061C7884FD765EF29D4867ABB7E1FB98304F000A3EE58FC3152EA74A5019B82

Function 0000019168206C10 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE ref: 0000019168206CD6

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c27442c9625b69612e30a0c621dafdc38b3cd1b2ea33eefe8ec2cdf5f7c33623
Instruction ID: 3a812bb88375a1baf216bda2e96298bd8ad82efebc4fef196e9188611cac0245
Opcode Fuzzy Hash: c27442c9625b69612e30a0c621dafdc38b3cd1b2ea33eefe8ec2cdf5f7c33623
Instruction Fuzzy Hash: 9D41A570714A0E2BEB59E73898E57EA32D3F794310F4006ADAD46C31C2DEA5D983C243

Function 000001916820778C Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 00000191682078B2

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: c6fe4b8a49b1c432d16a5d1b2244a4336856686fe2f0bc0d983b446ba2d85ae3
Instruction ID: 9aadabcb88432b9c5493e531cbde63460e7fc05bd83d8c81ef89f2596a205faa
Opcode Fuzzy Hash: c6fe4b8a49b1c432d16a5d1b2244a4336856686fe2f0bc0d983b446ba2d85ae3
Instruction Fuzzy Hash: 4A41B3B55187488BE76AEF24C8A47DBB3E1FB94300F004A5DE58AC3191EFB59545CB42

Function 000001916820CCD0 Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 000001916820CD2F

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2f464fde3477c0bba4832f44d3340180ae7d23497e5ed422822a87f1e6a42210
Instruction ID: f90d3dbf146afb143f7f623df9653f01a7dfff756476c58a03fc255910ed0843
Opcode Fuzzy Hash: 2f464fde3477c0bba4832f44d3340180ae7d23497e5ed422822a87f1e6a42210
Instruction Fuzzy Hash: 7D01C4B1604A0C9FE745FB19D8819A9B3EAFBD8314F50062AE88AC2150EF70DA55C781

Function 0000019168202904 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 000001916820293C

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a3e65a005f3911c52a3a19618f507bf36bcbd5794d57615cb3bbd7cad2f75c67
Instruction ID: 3d78b8a7e22f5735b483181ef3e7c8208fe79393a3bf135c9b2427a8fbf5fe87
Opcode Fuzzy Hash: a3e65a005f3911c52a3a19618f507bf36bcbd5794d57615cb3bbd7cad2f75c67
Instruction Fuzzy Hash: F4012B71B1491E9FEB54ABA9DC5866533D5FB8A316B1440A9D80AC3144D9399C42CB42

Function 0000019168202B50 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0000019168202B70

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: eab2b32177be9564e25d5777707ea1ca30621b5695f0306aefe172fe800bc35c
Instruction ID: 5459825f6cd5b9d9d9e854354e0398ac413cd6376256d0aeb01788f1cb474072
Opcode Fuzzy Hash: eab2b32177be9564e25d5777707ea1ca30621b5695f0306aefe172fe800bc35c
Instruction Fuzzy Hash: B2F0A0F1A05A0A6FF725AE765CE43AA2243E388312F64097FD806C7181D8B988C2C342

Function 000001916820697C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00000191682069A3

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: c691d5039295ecc8b7e044fb40fc3c69618cf93c91779b6bda279d67736a12d8
Instruction ID: 3e881898afc07486bdad6630af7aee0876150859108a1d3ea9aa56cd56d5e352
Opcode Fuzzy Hash: c691d5039295ecc8b7e044fb40fc3c69618cf93c91779b6bda279d67736a12d8
Instruction Fuzzy Hash: 52E0C261B04D1E1BABA861EE249CAB611C7D7DC27270402BFE81CC3299EC50CC828381

Function 00000191682074A0 Relevance: 1.5, APIs: 1, Instructions: 276COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000001916820757E

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef59572018a9deb8cc9717970e2f4ccce5bc515e763955c946e33fff9a11c9f9
Instruction ID: 771b44748d68763316a6dcb5a0bba2eb0e39c32524ea48ea1e796efc3d19a11c
Opcode Fuzzy Hash: ef59572018a9deb8cc9717970e2f4ccce5bc515e763955c946e33fff9a11c9f9
Instruction Fuzzy Hash: D091A370618A09AFEB45EF18C495BEA73F1FB94300F50459DE84AC7196DE71E885CB82

Function 0000019168203C84 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 0000019168203CB1

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: a4029a93bfcd341c8676454adb8c6f5f12b6913b14ed0bccef0902b234b6dd47
Instruction ID: 39c1e0573a5fa548644a39702d70728a1483ed5370e2e3f5f2ae157a092bea80
Opcode Fuzzy Hash: a4029a93bfcd341c8676454adb8c6f5f12b6913b14ed0bccef0902b234b6dd47
Instruction Fuzzy Hash: FDE04F705009055BEB98DB1DC90D79036E1FB9830AF60429CD804C9295CB79C4DBCF42

Function 00007DF449D01290 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF449D012BD

Memory Dump Source

Source File: 00000010.00000003.2034334262.00007DF449D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_7df449d01000_setup_wm.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: fc492990cf9c193ed0fed28dab1318ef1c2e9243cee28bd6a774944ac56baf31
Instruction ID: a6a35e9c7dcef8cfcbf2c10c9978e68798315a847e04ff6a0cccb930af549195
Opcode Fuzzy Hash: fc492990cf9c193ed0fed28dab1318ef1c2e9243cee28bd6a774944ac56baf31
Instruction Fuzzy Hash: 29E04F709049055BEB98EA2DC80AB503AE0FB5C30EF608669D509C9291CB79949BCF81

Function 00007DF449D11D34 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF449D11D61

Memory Dump Source

Source File: 00000010.00000002.2949847955.00007DF449D11000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7df449d11000_setup_wm.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: c9293ce4b305ba9868cbd6c67d8039fb85aeebd9cc4eecdb21d56eb0f10a1afb
Instruction ID: 9a4330b51ab48c69c247ab4a342a8a9a87bbc30e9d2ac11e54d8a7d61789adfd
Opcode Fuzzy Hash: c9293ce4b305ba9868cbd6c67d8039fb85aeebd9cc4eecdb21d56eb0f10a1afb
Instruction Fuzzy Hash: CFE086305009095FEFA8E71DC90979036E0EB5C30AF60426DD405C92D1DB7DD49BCF41

Function 0000019168206950 Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000019168206972

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: 0c218a45247dd382caaf312273fbe9d311c928ffe1ee742756daf908511eebc5
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 7AD0A760720D0E2FEA88637D1CE577551D6E7CC321F50067EB80AC2282D998CCD68341

Function 00007DF449D14464 Relevance: 1.5, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF449D11D34: RtlAddFunctionTable.KERNEL32 ref: 00007DF449D11D61

Part of subcall function 00007DF449D11D6C: VirtualProtect.KERNELBASE ref: 00007DF449D11D99

calloc.MSVCRT ref: 00007DF449D14549

Memory Dump Source

Source File: 00000010.00000002.2949847955.00007DF449D11000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF449D11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7df449d11000_setup_wm.jbxd

Similarity

API ID: FunctionProtectTableVirtualcalloc
String ID:
API String ID: 3747249976-0
Opcode ID: 8f131b3f7a0fe3efe94bcf360181135b30d73787cc5bce35fad1c891b4eeab41
Instruction ID: 2a803c03374603a566f43a457ea7214fdd2d1741453a667433fd2b196c4fd438
Opcode Fuzzy Hash: 8f131b3f7a0fe3efe94bcf360181135b30d73787cc5bce35fad1c891b4eeab41
Instruction Fuzzy Hash: 4D811571608A494FEB55FF28C896AB633E1FF98306B14412ED48FD3192DF78E8018781

Function 000001916820A76C Relevance: 1.4, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000001916820A7FB

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: d2cb0783aaccdf533b8783a245833ea662784d452517a49626c29c14fb2d72e4
Instruction ID: 507021884bc7e6abc2b15d668d18514c038c3a862ce5e13847877b35353e2a7f
Opcode Fuzzy Hash: d2cb0783aaccdf533b8783a245833ea662784d452517a49626c29c14fb2d72e4
Instruction Fuzzy Hash: 0241A371614D0E9FDB98EF2CD898AA5B7E1FB68311710466ED409C3661DB70E8C2CBC1

Function 000001916821D4AC Relevance: 1.3, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000001916821D4FE

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e53db298d0d7d8de9701e8a24c72cb59212fc55ca396913229799ff2ccd7724d
Instruction ID: 955e53af12bd742ce15a252e04298f2438f6c81b5ddbc227884e42a25ff45876
Opcode Fuzzy Hash: e53db298d0d7d8de9701e8a24c72cb59212fc55ca396913229799ff2ccd7724d
Instruction Fuzzy Hash: DB11967460191AEFEFB59F2988E43A533D0FB54316F1401BEDD49CA195CBB08C80C792

Function 0000019168244468 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0000019168244496

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5a17d2a82900e38e66e0587de357cfea25c88adc918405c2cab64094945da2f0
Instruction ID: 38af54dd1d0a214c72171a7d373ec6347477c6b570a2f0c32a68c83c125a0f65
Opcode Fuzzy Hash: 5a17d2a82900e38e66e0587de357cfea25c88adc918405c2cab64094945da2f0
Instruction Fuzzy Hash: C4F090B061AD0B5FEFA4EF6DC494F6133E0FB58320F6012999C0AC7185EA65CC81C761

Function 0000019168204998 Relevance: 1.3, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00000191682049CB

Memory Dump Source

Source File: 00000010.00000002.2948563905.0000019168201000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000019168201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_19168201000_setup_wm.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: f09fa07cc6f9e6f5b53de74bb20c91754370ab02738bba199ca246931610d18a
Instruction ID: 27477bed4209541b0997a8409ba02d1508f0c2bbf479a1489c1712c967cdc4fb
Opcode Fuzzy Hash: f09fa07cc6f9e6f5b53de74bb20c91754370ab02738bba199ca246931610d18a
Instruction Fuzzy Hash: 21F0E2B4650D0E4FF794AF2D98A876532D1EBA8302F55407A9809C32A0DEB8CCD1C302

Non-executed Functions

Function 00000191683F73F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000003.2007435070.00000191683F0000.00000004.00000800.00020000.00000000.sdmp, Offset: 00000191683F0000, based on PE: true

Associated: 00000010.00000003.2007690893.00000191683F0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000003.2027576995.0000019168400000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_191683f0000_setup_wm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea203756ed4986e3f8ed0ef8eca83a0d0cdf50b21de874dcc6b434622b4336d
Instruction ID: 83a832cd3c2245c3a05ba54cb365c717a26b55930336bc88c8e6673d36609d10
Opcode Fuzzy Hash: fea203756ed4986e3f8ed0ef8eca83a0d0cdf50b21de874dcc6b434622b4336d
Instruction Fuzzy Hash: 0BE0DA8344E7C00AC3039B64583120D3F3196D7E02B8B8087C7C0C7283E40C991DE322

Analysis Process: dllhost.exePID: 5232, Parent PID: 2656COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	210
Total number of Limit Nodes:	5

Executed Functions

Function 00000242782B385C Relevance: 1.8, APIs: 1, Instructions: 269
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000242782B3484: GetVolumeInformationW.KERNELBASE ref: 00000242782B35BB

NtQuerySystemInformation.NTDLL ref: 00000242782B39CF

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: Information$QuerySystemVolume
String ID:
API String ID: 2187445334-0
Opcode ID: b998b164d6ab368132463dabd2fb3c27ecb2e439103c33ace4e5ab262478c220
Instruction ID: 63a7908266d1e2dde663137c7040c52024381cff0e8571103a6a6326b1ee9fdf
Opcode Fuzzy Hash: b998b164d6ab368132463dabd2fb3c27ecb2e439103c33ace4e5ab262478c220
Instruction Fuzzy Hash: 6C91A331118F498FE795EB35C88D6F6B7E1FB54301F504A2AA45BC32A1EE34D5498781

Function 00000242782B2AC4 Relevance: .3, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c32461b9320785383341086f7141a18a3bf8380eb332f7633b5f4512ce5f88b
Instruction ID: 88f112e8de764eb0a5c3f691ec16d8753b8ff79fa88ed0c38ee11ca885d6d907
Opcode Fuzzy Hash: 3c32461b9320785383341086f7141a18a3bf8380eb332f7633b5f4512ce5f88b
Instruction Fuzzy Hash: 0EB1BA31219B89CBE706EB35C495BEBB7E1FB94301F400619B58BC7196EE34E909CB81

Function 00000242782D6E1C Relevance: 6.1, APIs: 4, Instructions: 130
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00000242782D6E25
socket.WS2_32 ref: 00000242782DA42B
getsockopt.WS2_32 ref: 00000242782DA45F
socket.WS2_32 ref: 00000242782DA494

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: socket$ErrorModegetsockopt
String ID:
API String ID: 552242919-0
Opcode ID: 62ba302f0329f40f35dd75de8e04dde68860fded8b8930806a0cd920fcc4434e
Instruction ID: 4f0e7311937fa436f4ec124e36c0e7ab951f646021cb12752b0f75c079e5bfa6
Opcode Fuzzy Hash: 62ba302f0329f40f35dd75de8e04dde68860fded8b8930806a0cd920fcc4434e
Instruction Fuzzy Hash: A64115305186488FE754EF29D8989A9B7E1FB98301F50871AE547C33E5DF388545CB41

Function 00000242782B3658 Relevance: 3.2, APIs: 2, Instructions: 176
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00000242782B3792
MapViewOfFile.KERNELBASE ref: 00000242782B37B9

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: a9a88122f699bc9801b18e66036a9d60db29c24016c60fe708909d2bcf45b252
Instruction ID: ea2e88746c74ba495265e7dcff34883b4f0224fa7b88b09ae6b3fb7cae57aa70
Opcode Fuzzy Hash: a9a88122f699bc9801b18e66036a9d60db29c24016c60fe708909d2bcf45b252
Instruction Fuzzy Hash: AB51723151CB888BD765EB25C8857FABBE0FB95301F404A2FB5DAC2191EF349509CB92

Function 00000242782D79E0 Relevance: 3.1, APIs: 2, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIoCompletionPort.KERNELBASE ref: 00000242782D7A42
SetFileCompletionNotificationModes.KERNEL32 ref: 00000242782D7A88

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: Completion$CreateFileModesNotificationPort
String ID:
API String ID: 3755109111-0
Opcode ID: 7b8d64a76d2febf9eaddd850e9b77060df4e2e166275f1d4614738d289a323de
Instruction ID: d0f4fa2cf11f15e30479c5055acf3620331cd9e2a3f6f4b5b62f728a039f449f
Opcode Fuzzy Hash: 7b8d64a76d2febf9eaddd850e9b77060df4e2e166275f1d4614738d289a323de
Instruction Fuzzy Hash: 2331D4303045958FFBA8AB2B988D379B6D4F754316FE0006AFA47C61D2EF29CD4587A1

Function 00000242782B3484 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE ref: 00000242782B35BB

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: cbef5665e4e33130d77fabd6912371dd21022a2eb90503feaf05fbace3e60585
Instruction ID: a899e94759ff2809f814dd6b49e32c7d4de0ae987382462a4bce138ba3739aa4
Opcode Fuzzy Hash: cbef5665e4e33130d77fabd6912371dd21022a2eb90503feaf05fbace3e60585
Instruction Fuzzy Hash: A65113711187888BE76AEB25C4987EBB7E0FB94301F504A2DF18AC31A1EF759509CB42

Function 00000242782D7DD0 Relevance: 1.6, APIs: 1, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00000242782D7DFD

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: e4aa1c51752cc51c1021b0ed71e26f07814a94f86ae376d8432b482f6f97e672
Instruction ID: 737cf0975c2228ad51bcd1303055a69cc430ee6dbc8e9f5c4897dcda24878722
Opcode Fuzzy Hash: e4aa1c51752cc51c1021b0ed71e26f07814a94f86ae376d8432b482f6f97e672
Instruction Fuzzy Hash: 7C21C7303045048FEB98BF3A988D77577D1EB58326FA0466AF92AC72D5EF388C458661

Function 00000242782B28D4 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00000242782B2949

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d458077baa02a7d1f90d469c50756c373027f953cef9f0edf197b8ea8fdb6eb5
Instruction ID: 067a53c2d3f88427abea44d0dd114628abf7e62910c1c08d4efdc421f5258d10
Opcode Fuzzy Hash: d458077baa02a7d1f90d469c50756c373027f953cef9f0edf197b8ea8fdb6eb5
Instruction Fuzzy Hash: B8018420316BC98AEB59B776485D3BDA6D6EB94312F8401297A0AD31D2FE14C9088741

Function 00000242782B28A0 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 00000242782B28C7

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 3c4e01abbe78d4e56a959f8bd0aad2c0fc2df47ecf812abe4fab89dd594e7c0f
Instruction ID: 68e87df4533445b1ad7d157ccca9b11e3251432ff2ecd7a9b2fb38bf91d0049e
Opcode Fuzzy Hash: 3c4e01abbe78d4e56a959f8bd0aad2c0fc2df47ecf812abe4fab89dd594e7c0f
Instruction Fuzzy Hash: 0EE02B11705D0D0BABA861BF248C77695C6C7DC273B44027BF91CC3295FD10CC450390

Function 00000242782B2874 Relevance: 1.5, APIs: 1, Instructions: 24
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000242782B2896

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6a07ba1f4b7a3d64463a1136aa0516904f1902b9a6f169df3d6500acee5e26bf
Instruction ID: 13cb2a85cc839e3b60b9b8bb20a5dd3553f9241537b443ee9b805d18c6bef09c
Opcode Fuzzy Hash: 6a07ba1f4b7a3d64463a1136aa0516904f1902b9a6f169df3d6500acee5e26bf
Instruction Fuzzy Hash: 04D0A710321D4E1BEA48633E1C9837555C6E7DC226F90153AB609C2285ED58CC590310

Function 00000242782C0DB0 Relevance: 1.4, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,?,00000242782B800F), ref: 00000242782C0EDA

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 298fe3d9a74ae48245d1c7bfb36be2b3989b8e08281fb95357af4992ff1d14e3
Instruction ID: b249e1298ac91d194b0f02f8fb2c551099a52299739bf89c93ed29a67c0b736d
Opcode Fuzzy Hash: 298fe3d9a74ae48245d1c7bfb36be2b3989b8e08281fb95357af4992ff1d14e3
Instruction Fuzzy Hash: 8F416230212E4DAFDBD4EF6A8899779B691FB58301FD00028AA1AC3282DE64DD598780

Function 00000242782B7FF4 Relevance: 1.3, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000242782C0DB0: free.MSVCRT(?,?,?,?,?,?,?,?,?,00000242782B800F), ref: 00000242782C0EDA

free.MSVCRT(?,?,?,?,?,?,?,00000242782B80FA,?,?,?,?,?,?,?,00000242782B454C), ref: 00000242782B8013

Memory Dump Source

Source File: 00000011.00000002.2948353565.00000242782B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000242782B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_242782b0000_dllhost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f9cead5ed533bf09888c19173bf4e4c63eb84cb88b8b7d93750e2c5822ebb7a4
Instruction ID: 6774badaab2a28ab6e7cbda378d43f2d6c492b8ef4518a2d5264f22b8356a7ae
Opcode Fuzzy Hash: f9cead5ed533bf09888c19173bf4e4c63eb84cb88b8b7d93750e2c5822ebb7a4
Instruction Fuzzy Hash: 01E012302169098BFF98BB76849D7387795EB58342F90006C751AC22A3DE14DC49D740

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TctqdRX5Wq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TctqdRX5Wq.exe.log

C:\Windows\Logs\SIH\SIH.20241006.042216.173.1.etl

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP3B3A.tmp

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMPCDA8.tmp

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
TctqdRX5Wq.exe

Function 02792145 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00D71268 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00D71270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre