Edit tour
Windows
Analysis Report
SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe |
| Analysis ID: | 1387375 |
| MD5: | 8dcbb40394210dc5287028e66fdbf0c7 |
| SHA1: | eb367c12ee4e8338a891b563f0b19204197c2ab9 |
| SHA256: | 526a3df9f947f4f372d58e8c0065792ab027f06b49fd4f7c705280b199b541a9 |
| Tags: | exe |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains sections with non-standard names
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Yara signature match
Classification
- System is w10x64
SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe (PID: 1072 cmdline: C:\Users\u ser\Deskto p\Securite Info.com.T rojan.MulD rop23.3422 6.5725.237 06.exe MD5: 8DCBB40394210DC5287028E66FDBF0C7) 
X.exe (PID: 3280 cmdline: "C:\Users\ user\AppDa ta\Roaming \X.exe" MD5: F57EC853B0F01B0E9954CFBF8FEEB081) - schtasks.exe (PID: 6560 cmdline:
C:\Windows \System32\ schtasks.e xe" /creat e /f /RL H IGHEST /sc minute /m o 1 /tn "S vchost" /t r "C:\User s\user\App Data\Local \Temp\Svch ost.exe MD5: 76CD6626DD8834BD4A42E6A565104DC2) 
conhost.exe (PID: 2580 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WerFault.exe (PID: 6768 cmdline: C:\Windows \system32\ WerFault.e xe -u -p 3 280 -s 173 2 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0) - 61c7cdb3196df.exe (PID: 2072 cmdline:
"C:\Users\ user\AppDa ta\Roaming \61c7cdb31 96df.exe" MD5: C0E5B07CBF2D02C54F39CE6AAD676DC7)
- svchost.exe (PID: 7096 cmdline:
C:\Windows \System32\ svchost.ex e -k WerSv cGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - WerFault.exe (PID: 5096 cmdline:
C:\Windows \system32\ WerFault.e xe -pss -s 440 -p 32 80 -ip 328 0 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- svchost.exe (PID: 4212 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s w lidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["trusting-smoke-90361.pktriot.net"], "Port": "22100", "Aes key": "<123456789>", "Install file": "USB.exe", "Version": "XWorm V5.2", "Telegram URL": "https://api.telegram.org/bot6731733957:AAGWQfODbJKr7tNuz5LDiFk41dKVxsOuAEA/sendMessage?chat_id=2031060627"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Click to see the 8 entries | ||||
System Summary |   |
|---|
| Source: | Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: | ||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: vburov: | ||
Persistence and Installation Behavior | |
|---|
| Source: | Author: Joe Security: | ||
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | URLs: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Code function: | 2_2_00007FF8880D7352 | |
| Source: | Code function: | 2_2_00007FF8880D65A6 | |
| Source: | Code function: | 2_2_00007FF8880D0E89 | |
| Source: | Code function: | 2_2_00007FF8880D17F5 | |
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Persistence and Installation Behavior | |
|---|
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Process created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 1 Scheduled Task/Job | 11 Process Injection | 11 Masquerading | OS Credential Dumping | 1 Query Registry | Remote Services | 11 Archive Collected Data | 1 Web Service | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Scheduled Task/Job | 21 Registry Run Keys / Startup Folder | 1 Scheduled Task/Job | 1 Disable or Modify Tools | LSASS Memory | 231 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | 21 Registry Run Keys / Startup Folder | 141 Virtualization/Sandbox Evasion | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Standard Port | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 DLL Side-Loading | 11 Process Injection | NTDS | 141 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 1 Ingress Tool Transfer | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | 2 Non-Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Obfuscated Files or Information | Cached Domain Credentials | 1 File and Directory Discovery | VNC | GUI Input Capture | 13 Application Layer Protocol | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Software Packing | DCSync | 23 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 72% | Virustotal | Browse | ||
| 88% | ReversingLabs | ByteCode-MSIL.Trojan.Cassiopeia | ||
| 100% | Avira | TR/Dropper.Gen | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | HEUR/AGEN.1305769 | ||
| 100% | Avira | HEUR/AGEN.1305769 | ||
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML | |||
| 82% | ReversingLabs | ByteCode-MSIL.Backdoor.XWorm | ||
| 77% | Virustotal | Browse | ||
| 11% | ReversingLabs | |||
| 10% | Virustotal | Browse | ||
| 82% | ReversingLabs | ByteCode-MSIL.Backdoor.XWorm | ||
| 77% | Virustotal | Browse |
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 13% | Virustotal | Browse | ||
| 1% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| api.telegram.org | 149.154.167.220 | true | false | high | |
| eu-central-7075.packetriot.net | 167.71.56.116 | true | false |
| unknown |
| trusting-smoke-90361.pktriot.net | unknown | unknown | true |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| low | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 149.154.167.220 | api.telegram.org | United Kingdom | 62041 | TELEGRAMRU | false | |
| 167.71.56.116 | eu-central-7075.packetriot.net | United States | 14061 | DIGITALOCEAN-ASNUS | false |
| Joe Sandbox version: | 39.0.0 Ruby |
| Analysis ID: | 1387375 |
| Start date and time: | 2024-02-06 09:32:18 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 8m 44s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 24 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@15/12@9/2 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, Svchost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, schtasks.exe
- Excluded IPs from analysis (whitelisted): 40.126.29.10, 40.126.29.8, 40.126.29.11, 40.126.29.5, 40.126.29.14, 20.190.157.11, 40.126.29.6, 40.126.29.13, 52.182.143.212
- Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
- Execution Graph export aborted for target SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe, PID 1072 because it is empty
- Execution Graph export aborted for target X.exe, PID 3280 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtDeviceIoControlFile calls found.
- Report size getting too big, too many NtOpenFile calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Report size getting too big, too many NtSetInformationFile calls found.
| Time | Type | Description |
|---|---|---|
| 08:33:25 | Autostart | |
| 08:33:26 | Task Scheduler | |
| 08:33:33 | Autostart | |
| 08:33:41 | Autostart | |
| 09:33:26 | API Interceptor | |
| 09:35:42 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 149.154.167.220 | Get hash | malicious | AgentTesla | Browse | ||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AMSIReaper | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AMSIReaper, AgentTesla | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AMSIReaper, AgentTesla | Browse | |||
| 167.71.56.116 | Get hash | malicious | Quasar | Browse | ||
| Get hash | malicious | Quasar | Browse | |||
| Get hash | malicious | AsyncRAT | Browse | |||
| Get hash | malicious | njRat | Browse | |||
| Get hash | malicious | Nanocore | Browse | |||
| Get hash | malicious | Nanocore | Browse | |||
| Get hash | malicious | AsyncRAT | Browse | |||
| Get hash | malicious | Njrat | Browse | |||
| Get hash | malicious | njRat | Browse | |||
| Get hash | malicious | njRat | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| eu-central-7075.packetriot.net | Get hash | malicious | Quasar | Browse |
| |
| Get hash | malicious | Quasar | Browse |
| ||
| Get hash | malicious | AsyncRAT | Browse |
| ||
| Get hash | malicious | njRat | Browse |
| ||
| Get hash | malicious | Nanocore | Browse |
| ||
| Get hash | malicious | Nanocore | Browse |
| ||
| Get hash | malicious | AsyncRAT | Browse |
| ||
| api.telegram.org | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AMSIReaper | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AMSIReaper, AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AMSIReaper, AgentTesla | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| TELEGRAMRU | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Clipboard Hijacker, Djvu, Fabookie, Glupteba, RedLine, SmokeLoader, Stealc | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AMSIReaper | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AMSIReaper, AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| DIGITALOCEAN-ASNUS | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DCRat | Browse |
| ||
| Get hash | malicious | Glupteba, SmokeLoader, Stealc | Browse |
| ||
| Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Remcos, PureLog Stealer | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | DCRat | Browse |
|
⊘No context
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_X.exe_74c56877658db65534a5802189718b692aaa75_91453fc5_d2f4ad29-3cf9-42d5-b13a-1a20bd5ddafb\Report.wer
Download File
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 65536 |
| Entropy (8bit): | 1.434973820107164 |
| Encrypted: | false |
| SSDEEP: | 192:SHnR5uek081iHy9MaWj8iyX8ClllX9IzuiFDZ24lO8zWnY:qfu281ixa48i/yVSzuiFDY4lO8C |
| MD5: | 9B83CD8C48A074A6D367FD3270A9E256 |
| SHA1: | 523FB837352381D8D69383F7C3AE86D557CFE445 |
| SHA-256: | FA6FF03E36F71B61A94772769933B514EB7CFDD34FE6EDF86C1A7E5608114F68 |
| SHA-512: | 5D30B2A302D3192A9D6076230D367B8EA1903DF2B1180902776062FB4269CAEDED98C6F707B4238C14FD0B12EC3F5B1FFFD67056782B66D34F11AF6EE64E5E52 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 559183 |
| Entropy (8bit): | 3.0112893927906543 |
| Encrypted: | false |
| SSDEEP: | 3072:uQHum4RhsWRj4cS066QrutPledQ1CCqhP1x8FHzoZYSVJWw53+vBAIWo4yiI1pok:u7SQY065W1qn53QzWoFiI |
| MD5: | 7E475450ACE996612E0074528694C7C6 |
| SHA1: | B84FAAE43CECEA25B4504B042E270EED13F482C5 |
| SHA-256: | 6DB8B9E002F7687A112D042CF7E459DC110767958F6BBA208FA2F33DC1AD104D |
| SHA-512: | E5DBA756608B59331E7B2513A587FC29D98CFF83CCBF3AC15D22DA87DBEC5EB69684813A34449892EFAE9A7C180227C7ABC444F76E909CB8E79F8108EBC4C309 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6856 |
| Entropy (8bit): | 3.7214820203371124 |
| Encrypted: | false |
| SSDEEP: | 192:R6l7wVeJgvZVZsIYZN8YprfP89bvNZbfilm:R6lXJQZVtYD0vzbf5 |
| MD5: | 7B1671C1313CF58B46D03A9CC907C8CF |
| SHA1: | 1AB74728D05BE993287B7FA2A13ECC394CDCC971 |
| SHA-256: | 02AAB5DC9B144A031A28D5D3A1BC8D5F5DE571FCD36C4770A2A6D2D6B409C35D |
| SHA-512: | 24D4C2EAF12B23EE9CD0B07C58D5721ACEEA7F19327A07F8AD96D3F264E825CCE832289F54E5B63929C3E06481992EF044894C9B3730460C9F0CA3B0B16535AF |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4717 |
| Entropy (8bit): | 4.422384087269718 |
| Encrypted: | false |
| SSDEEP: | 48:cvIwWl8zsXJg771I9eCq5WpW8VY6Ym8M4JbEFPNGyq8vV3Ythd:uIjf5I7FCqI7VmJwNGWRYthd |
| MD5: | 4768A63EA73736272555164C2B21CA79 |
| SHA1: | 516970A6EDDC8B879849F9ADADA97BD9608A79E8 |
| SHA-256: | BD77BFC4039A6DE25A24906BB6E311044B945E7BCFB548C5CC5DA84A8EAF9DBC |
| SHA-512: | 52E545DB2BF376B60C2C91687D10CC1527EEA33B0A3B1B72DAB1EA2E58A107D741F6D70486A55D7946081840143F8C6242A828DB4D5B231A00F7E8B0DD84F10B |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 77352 |
| Entropy (8bit): | 3.0736853801486363 |
| Encrypted: | false |
| SSDEEP: | 1536:a2e8IPCwf0ObU17XZm8gTzyYktKI+E++G+doKG+q+OG+uG+H+oSV+P+o+0+t+fEO:a2e8IPCwf0ObU17XZm8gTzyYkKI+E++h |
| MD5: | 5743EFDB51197701120D439B77AC2D9D |
| SHA1: | FC148237ABC8F3CD51B36DC0C3216EF7ABDA201E |
| SHA-256: | 461A71BEBD2E7AAA07E98E1CFDADB5CD6B475D102AC7D38AB16108C66F4123BD |
| SHA-512: | 86B15D33CDA2E8794F5380FC0478348F663044A5431D3BEEB330F69ED894D15B02C8C7F995BCE9FBE287DB8F46A5C03FC438933754EAFAFAFAFADE72002D41E8 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13340 |
| Entropy (8bit): | 2.685016712028871 |
| Encrypted: | false |
| SSDEEP: | 96:TiZYWA41DwhhYO6YUWaaH6YEZsdsCtdiGEKyBXwZM2YUaR+BM4vTocIUA3:2ZDA5/6/id68eUaR+BMCTobUA3 |
| MD5: | BB1D0C9A301FC81108B51F4F8AFCB1C6 |
| SHA1: | BA65993C8129254DBE791CEA98ABE2E1FDD99F29 |
| SHA-256: | AE3CE98DBD95A387A51D9022485FE71717D27D91DB9CBF011A1F4023DEA78B60 |
| SHA-512: | A1746F8C5DCA0C80C8FEDA9874EFEA2A6585760327E2B2E5CA2BA1AC9228AD64085B5F4C8B87990EAA478A764BB28CE82BBB3184B650CE5A2A43528B6395C19D |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe.log
Download File
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 654 |
| Entropy (8bit): | 5.380476433908377 |
| Encrypted: | false |
| SSDEEP: | 12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT |
| MD5: | 30E4BDFC34907D0E4D11152CAEBE27FA |
| SHA1: | 825402D6B151041BA01C5117387228EC9B7168BF |
| SHA-256: | A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63 |
| SHA-512: | 89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Roaming\X.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 36864 |
| Entropy (8bit): | 5.5767765436987435 |
| Encrypted: | false |
| SSDEEP: | 768:zDf+ZLVzkPLie7Vs6Ji5YYFg9KDO/hg/l193T:f+PzILv7di/Fg9KDO/Cd1dT |
| MD5: | F57EC853B0F01B0E9954CFBF8FEEB081 |
| SHA1: | F0197D2DA76F563373686DD104305D1EEB21EC7C |
| SHA-256: | 3D07268C23490174416EF5A8061E318B5B8B820CB89B27803996085C3B3EE927 |
| SHA-512: | 72593F450A183A53C81A70F9C23AB0EBA4CE46C64C3713F64A6606A3F3344305DFBE3D747FDE2C5353BCB6463EEEFC9B3B0B29395FEB9D71BC540A8D451A72AF |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1907200 |
| Entropy (8bit): | 5.216055990815914 |
| Encrypted: | false |
| SSDEEP: | 24576:+tjkC9sS0W1PJY7BaSjwI1nTmtO2WC780/TaSX88:w0MSNnWXWC71TaSX |
| MD5: | C0E5B07CBF2D02C54F39CE6AAD676DC7 |
| SHA1: | 4100B839D867B252FFA991F91FB9E403B8E41256 |
| SHA-256: | 0198B7C285A13C98123BBCF85D1B072BCC00F225F6D30867F4AB3BE1EA927DA8 |
| SHA-512: | 7E87CA707772BCFD2121F350A001C36A5EDA420E39F4612EF2D36F0B00734837BF5435421A1F005BF88CE4C6F83C79F10C46E8F7D9A793B9F970F88B8A64D87F |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.lnk
Download File
| Process: | C:\Users\user\AppData\Roaming\X.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1051 |
| Entropy (8bit): | 4.959171533602536 |
| Encrypted: | false |
| SSDEEP: | 12:8njC+4optCh/0eda1/obRacgKE/nEjAOqwZk1ngUNwuLxES4t2YZ/elFlSJmkmV:8njc2RmbRXgKwQAOqwZk17REOqygm |
| MD5: | 3DBA7D47DE032AA3FDDC671CF50B3CEC |
| SHA1: | BF88072E19B1FEDA9B7C73FADCC600550EFE4CF8 |
| SHA-256: | 5BD431EEAD7809DAE1B805CDC868757BDE29DE3951FE1431F2F206CEB94EC2B3 |
| SHA-512: | 5A7091C292AEFB511046132CC894A274DA0846C004EA6A4F80B58870E4BB3FAB20D7C67214BC5C652DA3E5C0841A78F3DE1260D175FF2ACFA2B1224B82107FE9 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 36864 |
| Entropy (8bit): | 5.5767765436987435 |
| Encrypted: | false |
| SSDEEP: | 768:zDf+ZLVzkPLie7Vs6Ji5YYFg9KDO/hg/l193T:f+PzILv7di/Fg9KDO/Cd1dT |
| MD5: | F57EC853B0F01B0E9954CFBF8FEEB081 |
| SHA1: | F0197D2DA76F563373686DD104305D1EEB21EC7C |
| SHA-256: | 3D07268C23490174416EF5A8061E318B5B8B820CB89B27803996085C3B3EE927 |
| SHA-512: | 72593F450A183A53C81A70F9C23AB0EBA4CE46C64C3713F64A6606A3F3344305DFBE3D747FDE2C5353BCB6463EEEFC9B3B0B29395FEB9D71BC540A8D451A72AF |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1835008 |
| Entropy (8bit): | 4.393843540338418 |
| Encrypted: | false |
| SSDEEP: | 6144:xl4fiJoH0ncNXiUjt10qTG/gaocYGBoaUMMhA2NX4WABlBuNAMOBSqa:n4vFTMYQUMM6VFYSMU |
| MD5: | 24DAA3660CF186618750EF08E84EDDF6 |
| SHA1: | 1D5D89CEE862CBACB7091EDF36AF0C8310EA2FAD |
| SHA-256: | CFE5E74983F57791C8206AAC4F0709653212123BE80DC2EE86A370B443E57E12 |
| SHA-512: | 4DB24706774D496115FD2965F8598EAF2FB980E22F6B009A37FDA55DA689525A4717F8E4C7F0A4FB404E9EA11115C09F5261ADAA586DC23607B4884BCF0803D1 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.287641041986272 |
| TrID: |
|
| File name: | SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe |
| File size: | 2'324'480 bytes |
| MD5: | 8dcbb40394210dc5287028e66fdbf0c7 |
| SHA1: | eb367c12ee4e8338a891b563f0b19204197c2ab9 |
| SHA256: | 526a3df9f947f4f372d58e8c0065792ab027f06b49fd4f7c705280b199b541a9 |
| SHA512: | 08877c0da26d59ec1c2f33d7c07c13f88604ead5bd010f067fb6c4892791956efe2b9e350e4797d57e499eb5ca1174e982842abd5c4ece402010b21a1eefb77d |
| SSDEEP: | 24576:rPUo7mlbJzEEKPZdSj1EmP63dOAAD28Uwm76NNrMQyC5O0uuqc4CJqwTz:2zPKZHmy38D9bE0BqwTz |
| TLSH: | AAB59884501A2635C01272F40A1FF2BDD38B5D8169519AACE1B8FC5BF43C697EE38B9D |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..e................................. ........@.. ........................#...........@................................ |
 | |
| Icon Hash: | 134544052b964e2d |
| Entrypoint: | 0x5de68e |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x65A98144 [Thu Jan 18 19:51:32 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Instruction |
|---|
| jmp dword ptr [00402000h] |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x1de640 | 0x4b | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1e0000 | 0x5abe4 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x23c000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0x1dc694 | 0x1dc800 | eef6402bd13b0e48e2049fa886cca513 | False | 0.6256655585978489 | data | 7.7009507911079 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x1e0000 | 0x5abe4 | 0x5ac00 | e6ea1197538702d40c3777d7d1318ab7 | False | 0.03392411329201102 | data | 1.6048341827288495 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x23c000 | 0xc | 0x200 | 924df3d2c0aeebe2aad14bd4a9b1849d | False | 0.044921875 | data | 0.10191042566270775 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x1e0220 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | 0.24202127659574468 | ||
| RT_ICON | 0x1e0688 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | 0.13860225140712945 | ||
| RT_ICON | 0x1e1730 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | 0.09533195020746887 | ||
| RT_ICON | 0x1e3cd8 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 0 | 0.07575578649031649 | ||
| RT_ICON | 0x1e7f00 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 0 | 0.04229267715603928 | ||
| RT_ICON | 0x1f8728 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 0 | 0.022150634671716424 | ||
| RT_GROUP_ICON | 0x23a750 | 0x5a | data | 0.7333333333333333 | ||
| RT_VERSION | 0x23a7ac | 0x24c | data | 0.46598639455782315 | ||
| RT_MANIFEST | 0x23a9f8 | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5469387755102041 |
| DLL | Import |
|---|---|
| mscoree.dll | _CorExeMain |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Feb 6, 2024 09:33:26.921504974 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:26.921555042 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:26.921632051 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:26.944355965 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:26.944399118 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.360228062 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.360313892 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:27.363820076 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:27.363843918 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.364094973 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.411758900 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:27.457736969 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:27.501914024 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.845469952 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.845541000 CET | 443 | 49705 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.845599890 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:27.862315893 CET | 49705 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:33:28.166486025 CET | 49706 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:28.375896931 CET | 22100 | 49706 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:28.377966881 CET | 49706 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:28.425318003 CET | 49706 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:28.587222099 CET | 22100 | 49706 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:28.588107109 CET | 49706 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:28.634758949 CET | 22100 | 49706 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:28.646503925 CET | 49706 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:28.648844004 CET | 49707 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:28.798111916 CET | 22100 | 49706 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:28.854295969 CET | 22100 | 49707 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:28.854422092 CET | 49707 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:28.855405092 CET | 22100 | 49706 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:28.881202936 CET | 49707 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.060039043 CET | 22100 | 49707 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.061822891 CET | 49707 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.086616993 CET | 22100 | 49707 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.099531889 CET | 49707 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.102137089 CET | 49708 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.267239094 CET | 22100 | 49707 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.305048943 CET | 22100 | 49707 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.306438923 CET | 22100 | 49708 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.306524992 CET | 49708 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.337274075 CET | 49708 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.510898113 CET | 22100 | 49708 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.510999918 CET | 49708 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.541692972 CET | 22100 | 49708 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.552712917 CET | 49708 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.554802895 CET | 49709 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.715220928 CET | 22100 | 49708 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.756951094 CET | 22100 | 49708 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.763358116 CET | 22100 | 49709 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.763454914 CET | 49709 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.784722090 CET | 49709 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.972853899 CET | 22100 | 49709 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:29.972912073 CET | 49709 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:29.993647099 CET | 22100 | 49709 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:30.181200027 CET | 22100 | 49709 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:34.577383041 CET | 49710 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:34.786952972 CET | 22100 | 49710 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:34.787125111 CET | 49710 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:34.830774069 CET | 49710 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:34.996668100 CET | 22100 | 49710 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:34.996772051 CET | 49710 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.040342093 CET | 22100 | 49710 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.045160055 CET | 49710 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.051130056 CET | 49711 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.206259966 CET | 22100 | 49710 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.254302979 CET | 22100 | 49710 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.259887934 CET | 22100 | 49711 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.260004997 CET | 49711 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.419441938 CET | 49711 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.469249964 CET | 22100 | 49711 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.469321012 CET | 49711 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.521790981 CET | 49711 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.525772095 CET | 49712 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.627862930 CET | 22100 | 49711 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.677458048 CET | 22100 | 49711 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.730694056 CET | 22100 | 49711 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.736514091 CET | 22100 | 49712 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.737004995 CET | 49712 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.761053085 CET | 49712 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.954341888 CET | 22100 | 49712 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:35.954710960 CET | 49712 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:35.971733093 CET | 22100 | 49712 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:36.165734053 CET | 22100 | 49712 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:36.593904018 CET | 49713 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:36.799556971 CET | 22100 | 49713 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:36.799628019 CET | 49713 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:37.005069017 CET | 22100 | 49713 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:37.005178928 CET | 49713 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:37.495212078 CET | 49713 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:37.700725079 CET | 22100 | 49713 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:41.840131998 CET | 49719 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.049465895 CET | 22100 | 49719 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.049549103 CET | 49719 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.075062990 CET | 49719 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.258939981 CET | 22100 | 49719 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.259026051 CET | 49719 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.284024954 CET | 22100 | 49719 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.287190914 CET | 49719 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.288892984 CET | 49720 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.469721079 CET | 22100 | 49719 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.496241093 CET | 22100 | 49719 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.500214100 CET | 22100 | 49720 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.501096964 CET | 49720 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.521785975 CET | 49720 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.712378979 CET | 22100 | 49720 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.713927031 CET | 49720 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:42.732764959 CET | 22100 | 49720 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:42.927761078 CET | 22100 | 49720 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:46.726351976 CET | 49721 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:46.941581011 CET | 22100 | 49721 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:46.941670895 CET | 49721 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:46.970693111 CET | 49721 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:47.156987906 CET | 22100 | 49721 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:47.157134056 CET | 49721 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:47.185694933 CET | 22100 | 49721 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:47.193351984 CET | 49721 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:47.195255995 CET | 49722 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:47.372288942 CET | 22100 | 49721 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:47.403738976 CET | 22100 | 49722 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:47.403892040 CET | 49722 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:47.408380985 CET | 22100 | 49721 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:47.428414106 CET | 49722 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:47.612554073 CET | 22100 | 49722 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:47.612665892 CET | 49722 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:47.636708975 CET | 22100 | 49722 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:47.820950031 CET | 22100 | 49722 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:51.398689032 CET | 49723 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:51.602571011 CET | 22100 | 49723 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:51.602668047 CET | 49723 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:51.624735117 CET | 49723 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:51.806700945 CET | 22100 | 49723 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:51.806801081 CET | 49723 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:51.828464031 CET | 22100 | 49723 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:51.849944115 CET | 49723 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:51.852504015 CET | 49724 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:52.010484934 CET | 22100 | 49723 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:52.053841114 CET | 22100 | 49723 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:52.058248997 CET | 22100 | 49724 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:52.058326960 CET | 49724 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:52.085697889 CET | 49724 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:52.264373064 CET | 22100 | 49724 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:52.264653921 CET | 49724 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:52.291380882 CET | 22100 | 49724 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:52.470844030 CET | 22100 | 49724 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:56.586318016 CET | 49725 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:56.793066978 CET | 22100 | 49725 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:56.793241024 CET | 49725 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:56.818622112 CET | 49725 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:57.000017881 CET | 22100 | 49725 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:57.000121117 CET | 49725 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:33:57.025049925 CET | 22100 | 49725 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:33:57.206527948 CET | 22100 | 49725 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:01.214201927 CET | 49726 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:01.419498920 CET | 22100 | 49726 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:01.419645071 CET | 49726 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:01.448504925 CET | 49726 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:01.626194000 CET | 22100 | 49726 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:01.626266003 CET | 49726 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:01.656092882 CET | 22100 | 49726 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:01.831326008 CET | 22100 | 49726 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:04.913556099 CET | 49727 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.119144917 CET | 22100 | 49727 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.119272947 CET | 49727 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.146044016 CET | 49727 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.324644089 CET | 22100 | 49727 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.324826002 CET | 49727 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.351175070 CET | 22100 | 49727 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.364998102 CET | 49727 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.366813898 CET | 49728 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.530395031 CET | 22100 | 49727 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.570266962 CET | 22100 | 49727 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.574062109 CET | 22100 | 49728 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.574168921 CET | 49728 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.595226049 CET | 49728 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.781816959 CET | 22100 | 49728 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.781908989 CET | 49728 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:05.802359104 CET | 22100 | 49728 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:05.989211082 CET | 22100 | 49728 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:08.986685038 CET | 49729 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:09.191935062 CET | 22100 | 49729 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:09.192156076 CET | 49729 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:09.213314056 CET | 49729 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:09.396519899 CET | 22100 | 49729 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:09.396584034 CET | 49729 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:09.417037010 CET | 22100 | 49729 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:09.600328922 CET | 22100 | 49729 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:12.476496935 CET | 49730 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:12.687283993 CET | 22100 | 49730 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:12.687412024 CET | 49730 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:12.704190016 CET | 49730 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:12.898231030 CET | 22100 | 49730 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:12.898431063 CET | 49730 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:12.914736032 CET | 22100 | 49730 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:13.108953953 CET | 22100 | 49730 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:15.023345947 CET | 49731 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:15.238435984 CET | 22100 | 49731 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:15.240299940 CET | 49731 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:15.257075071 CET | 49731 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:15.455329895 CET | 22100 | 49731 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:15.455389023 CET | 49731 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:15.471924067 CET | 22100 | 49731 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:15.670278072 CET | 22100 | 49731 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:18.117104053 CET | 49733 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:18.323419094 CET | 22100 | 49733 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:18.323550940 CET | 49733 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:18.340578079 CET | 49733 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:18.530041933 CET | 22100 | 49733 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:18.530163050 CET | 49733 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:18.546732903 CET | 22100 | 49733 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:18.736923933 CET | 22100 | 49733 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:20.118175983 CET | 49734 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:20.323915958 CET | 22100 | 49734 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:20.324017048 CET | 49734 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:20.342726946 CET | 49734 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:20.530050993 CET | 22100 | 49734 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:20.530150890 CET | 49734 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:20.548274994 CET | 22100 | 49734 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:20.735845089 CET | 22100 | 49734 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:22.509008884 CET | 49735 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:22.717544079 CET | 22100 | 49735 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:22.717746019 CET | 49735 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:22.735097885 CET | 49735 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:22.926250935 CET | 22100 | 49735 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:22.926394939 CET | 49735 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:22.943295956 CET | 22100 | 49735 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:23.133727074 CET | 22100 | 49735 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:24.211575031 CET | 49736 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:24.417798042 CET | 22100 | 49736 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:24.417892933 CET | 49736 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:24.438246965 CET | 49736 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:24.624787092 CET | 22100 | 49736 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:24.624955893 CET | 49736 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:24.643923044 CET | 22100 | 49736 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:24.830559969 CET | 22100 | 49736 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:26.382632971 CET | 49737 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:26.598009109 CET | 22100 | 49737 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:26.598143101 CET | 49737 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:26.615935087 CET | 49737 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:26.813570976 CET | 22100 | 49737 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:26.813640118 CET | 49737 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:26.830924988 CET | 22100 | 49737 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:27.028805971 CET | 22100 | 49737 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:27.737648964 CET | 49738 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:27.948808908 CET | 22100 | 49738 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:27.948965073 CET | 49738 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:27.978200912 CET | 49738 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:28.160185099 CET | 22100 | 49738 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:28.160350084 CET | 49738 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:28.189240932 CET | 22100 | 49738 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:28.214761019 CET | 49738 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:28.216519117 CET | 49739 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:28.371346951 CET | 22100 | 49738 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:28.422368050 CET | 22100 | 49739 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:28.422487974 CET | 49739 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:28.425616026 CET | 22100 | 49738 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:28.449388981 CET | 49739 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:28.628822088 CET | 22100 | 49739 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:28.628967047 CET | 49739 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:28.655091047 CET | 22100 | 49739 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:28.834714890 CET | 22100 | 49739 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:30.274259090 CET | 49740 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:30.486188889 CET | 22100 | 49740 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:30.486260891 CET | 49740 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:30.508315086 CET | 49740 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:30.698306084 CET | 22100 | 49740 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:30.698436022 CET | 49740 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:30.721580029 CET | 22100 | 49740 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:30.910115957 CET | 22100 | 49740 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:31.429724932 CET | 49741 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:31.639688015 CET | 22100 | 49741 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:31.639803886 CET | 49741 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:31.656950951 CET | 49741 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:31.849591017 CET | 22100 | 49741 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:31.849911928 CET | 49741 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:31.867814064 CET | 22100 | 49741 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:32.060883045 CET | 22100 | 49741 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:32.507642984 CET | 49742 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:32.716397047 CET | 22100 | 49742 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:32.716603041 CET | 49742 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:32.732958078 CET | 49742 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:32.925956011 CET | 22100 | 49742 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:32.927756071 CET | 49742 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:32.942636013 CET | 22100 | 49742 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:33.136354923 CET | 22100 | 49742 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:33.772989035 CET | 49743 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:33.976422071 CET | 22100 | 49743 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:33.976516962 CET | 49743 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:33.992719889 CET | 49743 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:34.179951906 CET | 22100 | 49743 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:34.180056095 CET | 49743 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:34.196012974 CET | 22100 | 49743 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:34.383295059 CET | 22100 | 49743 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:34.710804939 CET | 49744 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:34.916527033 CET | 22100 | 49744 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:34.916635990 CET | 49744 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:34.933056116 CET | 49744 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:35.122529984 CET | 22100 | 49744 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:35.122623920 CET | 49744 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:35.138169050 CET | 22100 | 49744 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:35.328248978 CET | 22100 | 49744 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:35.617664099 CET | 49745 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:35.834774971 CET | 22100 | 49745 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:35.835000992 CET | 49745 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:35.852015018 CET | 49745 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.051944017 CET | 22100 | 49745 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:36.052915096 CET | 49745 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.068773985 CET | 22100 | 49745 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:36.271461010 CET | 22100 | 49745 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:36.290385008 CET | 49746 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.499705076 CET | 22100 | 49746 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:36.499891043 CET | 49746 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.520823956 CET | 49746 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.708936930 CET | 22100 | 49746 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:36.712150097 CET | 49746 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.729784966 CET | 22100 | 49746 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:36.896488905 CET | 49746 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.899250031 CET | 49747 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:36.921214104 CET | 22100 | 49746 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.105734110 CET | 22100 | 49746 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.116014957 CET | 22100 | 49747 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.119946957 CET | 49747 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.141738892 CET | 49747 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.338608027 CET | 22100 | 49747 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.338670015 CET | 49747 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.361083031 CET | 22100 | 49747 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.444852114 CET | 49747 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.449409008 CET | 49748 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.557549953 CET | 22100 | 49747 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.655266047 CET | 22100 | 49748 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.655348063 CET | 49748 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.664025068 CET | 22100 | 49747 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.675343037 CET | 49748 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.858570099 CET | 22100 | 49748 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:37.858659983 CET | 49748 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:37.878596067 CET | 22100 | 49748 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.061769962 CET | 22100 | 49748 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.103060007 CET | 49749 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:38.314830065 CET | 22100 | 49749 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.314930916 CET | 49749 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:38.334779978 CET | 49749 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:38.525974989 CET | 22100 | 49749 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.526058912 CET | 49749 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:38.545711994 CET | 22100 | 49749 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.568428040 CET | 49749 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:38.571877956 CET | 49750 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:38.736917973 CET | 22100 | 49749 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.779584885 CET | 22100 | 49749 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.788120031 CET | 22100 | 49750 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:38.788206100 CET | 49750 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:38.814779997 CET | 49750 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.005876064 CET | 22100 | 49750 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.009854078 CET | 49750 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.029994965 CET | 22100 | 49750 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.099678993 CET | 49750 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.103868961 CET | 49751 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.227276087 CET | 22100 | 49750 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.313564062 CET | 22100 | 49751 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.313725948 CET | 49751 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.314863920 CET | 22100 | 49750 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.333512068 CET | 49751 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.523374081 CET | 22100 | 49751 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.523462057 CET | 49751 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.542793989 CET | 22100 | 49751 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.599574089 CET | 49751 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.601970911 CET | 49754 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.732361078 CET | 22100 | 49751 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.806884050 CET | 22100 | 49754 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.806982040 CET | 49754 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:39.809056044 CET | 22100 | 49751 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:39.861183882 CET | 49754 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.011957884 CET | 22100 | 49754 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.012082100 CET | 49754 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.065642118 CET | 22100 | 49754 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.099549055 CET | 49754 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.102132082 CET | 49756 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.217089891 CET | 22100 | 49754 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.304325104 CET | 22100 | 49754 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.317449093 CET | 22100 | 49756 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.317585945 CET | 49756 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.337587118 CET | 49756 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.532780886 CET | 22100 | 49756 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.532888889 CET | 49756 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.556056023 CET | 22100 | 49756 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.594016075 CET | 49756 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.597311020 CET | 49757 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.749090910 CET | 22100 | 49756 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.810625076 CET | 22100 | 49756 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.812158108 CET | 22100 | 49757 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:40.812277079 CET | 49757 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:40.831491947 CET | 49757 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.023726940 CET | 22100 | 49757 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.023937941 CET | 49757 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.036973953 CET | 49757 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.042620897 CET | 22100 | 49757 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.222059011 CET | 49758 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.235174894 CET | 22100 | 49757 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.248161077 CET | 22100 | 49757 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.430504084 CET | 22100 | 49758 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.430754900 CET | 49758 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.449316025 CET | 49758 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.640283108 CET | 22100 | 49758 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.640360117 CET | 49758 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.646584034 CET | 49758 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.649633884 CET | 49759 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.658427000 CET | 22100 | 49758 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.848685980 CET | 22100 | 49758 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.854819059 CET | 22100 | 49758 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.855052948 CET | 22100 | 49759 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.855148077 CET | 49759 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:41.895102024 CET | 49759 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.061043978 CET | 22100 | 49759 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.061109066 CET | 49759 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.100480080 CET | 22100 | 49759 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.130786896 CET | 49759 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.133249044 CET | 49760 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.267702103 CET | 22100 | 49759 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.336066008 CET | 22100 | 49759 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.343277931 CET | 22100 | 49760 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.343372107 CET | 49760 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.362333059 CET | 49760 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.552740097 CET | 22100 | 49760 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.552896023 CET | 49760 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.572272062 CET | 22100 | 49760 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.583971977 CET | 49760 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.587225914 CET | 49761 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.762656927 CET | 22100 | 49760 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.790581942 CET | 22100 | 49761 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.790719986 CET | 49761 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.793937922 CET | 22100 | 49760 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.808454037 CET | 49761 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:42.994368076 CET | 22100 | 49761 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:42.994493961 CET | 49761 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.011812925 CET | 22100 | 49761 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.021656036 CET | 49761 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.024960995 CET | 49762 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.197762966 CET | 22100 | 49761 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.224987030 CET | 22100 | 49761 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.232467890 CET | 22100 | 49762 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.232552052 CET | 49762 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.263140917 CET | 49762 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.440123081 CET | 22100 | 49762 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.441824913 CET | 49762 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.453439951 CET | 49762 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.456890106 CET | 49763 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.474143028 CET | 22100 | 49762 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.649112940 CET | 22100 | 49762 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.660326958 CET | 22100 | 49763 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.660409927 CET | 49763 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.660779953 CET | 22100 | 49762 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.697784901 CET | 49763 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.864166975 CET | 22100 | 49763 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:43.864281893 CET | 49763 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.866070986 CET | 49763 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.869524956 CET | 49764 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:43.901036978 CET | 22100 | 49763 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.067481995 CET | 22100 | 49763 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.069525003 CET | 22100 | 49763 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.074786901 CET | 22100 | 49764 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.074934959 CET | 49764 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.091942072 CET | 49764 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.280267954 CET | 22100 | 49764 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.280344963 CET | 49764 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.284173012 CET | 49764 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.287656069 CET | 49765 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.296859026 CET | 22100 | 49764 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.485609055 CET | 22100 | 49764 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.489010096 CET | 22100 | 49764 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.502629995 CET | 22100 | 49765 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.502743959 CET | 49765 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.521006107 CET | 49765 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.717912912 CET | 22100 | 49765 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.718066931 CET | 49765 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.720916986 CET | 49766 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.720943928 CET | 49765 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.735861063 CET | 22100 | 49765 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.926176071 CET | 22100 | 49766 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.926274061 CET | 49766 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:44.932773113 CET | 22100 | 49765 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.935782909 CET | 22100 | 49765 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:44.944967985 CET | 49766 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:45.131330967 CET | 22100 | 49766 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:45.131418943 CET | 49766 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:45.149801016 CET | 22100 | 49766 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:45.336338043 CET | 22100 | 49766 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:50.025384903 CET | 49767 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:50.231399059 CET | 22100 | 49767 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:50.231590033 CET | 49767 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:50.248153925 CET | 49767 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:50.437613010 CET | 22100 | 49767 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:50.437788963 CET | 49767 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:50.454021931 CET | 22100 | 49767 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:50.643620968 CET | 22100 | 49767 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:55.263353109 CET | 49768 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:55.469203949 CET | 22100 | 49768 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:55.469304085 CET | 49768 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:55.483764887 CET | 49768 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:55.675460100 CET | 22100 | 49768 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:55.675618887 CET | 49768 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:34:55.689589977 CET | 22100 | 49768 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:34:55.881784916 CET | 22100 | 49768 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:00.570940018 CET | 49769 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:00.778227091 CET | 22100 | 49769 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:00.778373003 CET | 49769 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:00.805912018 CET | 49769 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:00.984877110 CET | 22100 | 49769 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:00.984996080 CET | 49769 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:01.012629986 CET | 22100 | 49769 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:01.192060947 CET | 22100 | 49769 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:05.961304903 CET | 49770 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:06.172291994 CET | 22100 | 49770 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:06.172378063 CET | 49770 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:06.188306093 CET | 49770 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:06.383441925 CET | 22100 | 49770 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:06.383503914 CET | 49770 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:06.398969889 CET | 22100 | 49770 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:06.594250917 CET | 22100 | 49770 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:11.434312105 CET | 49771 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:11.644901037 CET | 22100 | 49771 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:11.645042896 CET | 49771 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:11.659171104 CET | 49771 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:11.854876041 CET | 22100 | 49771 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:11.854993105 CET | 49771 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:11.855063915 CET | 49771 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:11.857959986 CET | 49772 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:11.868868113 CET | 22100 | 49771 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:12.064635992 CET | 22100 | 49771 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:12.064662933 CET | 22100 | 49771 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:12.074713945 CET | 22100 | 49772 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:12.074801922 CET | 49772 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:12.092818975 CET | 49772 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:12.291676044 CET | 22100 | 49772 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:12.291775942 CET | 49772 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:12.309386969 CET | 22100 | 49772 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:12.508492947 CET | 22100 | 49772 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:17.117731094 CET | 49773 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:17.322386026 CET | 22100 | 49773 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:17.322496891 CET | 49773 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:17.336854935 CET | 49773 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:17.527035952 CET | 22100 | 49773 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:17.527151108 CET | 49773 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:17.541243076 CET | 22100 | 49773 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:17.731504917 CET | 22100 | 49773 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:22.446192026 CET | 49774 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:22.663464069 CET | 22100 | 49774 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:22.663718939 CET | 49774 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:22.684453964 CET | 49774 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:22.881539106 CET | 22100 | 49774 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:22.881618977 CET | 49774 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:22.881678104 CET | 49774 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:22.884008884 CET | 49775 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:22.905015945 CET | 22100 | 49774 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:23.098479033 CET | 22100 | 49774 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:23.098501921 CET | 22100 | 49774 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:23.098653078 CET | 22100 | 49775 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:23.098725080 CET | 49775 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:23.132141113 CET | 49775 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:23.313529968 CET | 22100 | 49775 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:23.313632965 CET | 49775 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:23.346750975 CET | 22100 | 49775 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:23.528353930 CET | 22100 | 49775 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:28.181464911 CET | 49776 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:28.388689995 CET | 22100 | 49776 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:28.388801098 CET | 49776 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:28.404823065 CET | 49776 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:28.596096039 CET | 22100 | 49776 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:28.596151114 CET | 49776 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:28.596214056 CET | 49776 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:28.598412991 CET | 49777 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:28.611654997 CET | 22100 | 49776 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:28.802748919 CET | 22100 | 49776 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:28.802778959 CET | 22100 | 49776 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:28.809166908 CET | 22100 | 49777 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:28.809407949 CET | 49777 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:28.832938910 CET | 49777 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:29.020220995 CET | 22100 | 49777 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:29.020360947 CET | 49777 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:29.043744087 CET | 22100 | 49777 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:29.231023073 CET | 22100 | 49777 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:33.868942022 CET | 49778 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:34.084069014 CET | 22100 | 49778 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:34.084242105 CET | 49778 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:34.103312016 CET | 49778 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:34.300669909 CET | 22100 | 49778 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:34.300764084 CET | 49778 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:34.317847967 CET | 22100 | 49778 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:34.516633034 CET | 22100 | 49778 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:43.245074034 CET | 49783 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:35:43.455756903 CET | 22100 | 49783 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:35:43.455838919 CET | 49783 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:06.301181078 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:06.301220894 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:06.301321983 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:06.308819056 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:06.308844090 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:06.735433102 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:06.735529900 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:06.738158941 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:06.738184929 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:06.738568068 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:06.786803961 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:06.845228910 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:06.885901928 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:07.228718996 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:07.228794098 CET | 443 | 49784 | 149.154.167.220 | 192.168.2.9 |
| Feb 6, 2024 09:36:07.228925943 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:07.229911089 CET | 49784 | 443 | 192.168.2.9 | 149.154.167.220 |
| Feb 6, 2024 09:36:11.870328903 CET | 49786 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.074152946 CET | 22100 | 49786 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.074242115 CET | 49786 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.111498117 CET | 49786 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.278306961 CET | 22100 | 49786 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.278425932 CET | 49786 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.315186977 CET | 22100 | 49786 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.334188938 CET | 49786 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.335623980 CET | 49787 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.482208014 CET | 22100 | 49786 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.537920952 CET | 22100 | 49786 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.543998957 CET | 22100 | 49787 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.544198990 CET | 49787 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.566510916 CET | 49787 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.752509117 CET | 22100 | 49787 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.752794027 CET | 49787 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.775147915 CET | 22100 | 49787 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.787213087 CET | 49787 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.790693045 CET | 49788 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:12.961553097 CET | 22100 | 49787 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:12.995660067 CET | 22100 | 49787 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:13.005332947 CET | 22100 | 49788 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:13.005408049 CET | 49788 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:13.030066967 CET | 49788 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:13.220340967 CET | 22100 | 49788 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:13.220535994 CET | 49788 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:13.244769096 CET | 22100 | 49788 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:13.435309887 CET | 22100 | 49788 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:16.945493937 CET | 49789 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.157180071 CET | 22100 | 49789 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:17.157535076 CET | 49789 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.185164928 CET | 49789 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.369054079 CET | 22100 | 49789 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:17.369417906 CET | 49789 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.396320105 CET | 22100 | 49789 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:17.396989107 CET | 49789 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.399847031 CET | 49790 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.580683947 CET | 22100 | 49789 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:17.610946894 CET | 22100 | 49789 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:17.611337900 CET | 22100 | 49790 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:17.611577034 CET | 49790 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.636531115 CET | 49790 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.820966005 CET | 22100 | 49790 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:17.821249008 CET | 49790 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:17.845637083 CET | 22100 | 49790 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:18.030622959 CET | 22100 | 49790 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:21.962075949 CET | 49791 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.173857927 CET | 22100 | 49791 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.174109936 CET | 49791 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.200562954 CET | 49791 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.385951042 CET | 22100 | 49791 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.386037111 CET | 49791 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.411927938 CET | 22100 | 49791 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.412075996 CET | 49791 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.413882017 CET | 49792 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.597455025 CET | 22100 | 49791 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.619311094 CET | 22100 | 49792 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.619426012 CET | 49792 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.623132944 CET | 22100 | 49791 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.653265953 CET | 49792 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.825098038 CET | 22100 | 49792 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.825764894 CET | 49792 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.858546019 CET | 22100 | 49792 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:22.865923882 CET | 49792 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:22.867949963 CET | 49793 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:23.031101942 CET | 22100 | 49792 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:23.071249962 CET | 22100 | 49792 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:23.079180956 CET | 22100 | 49793 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:23.079292059 CET | 49793 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:23.110665083 CET | 49793 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:23.290738106 CET | 22100 | 49793 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:23.290940046 CET | 49793 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:23.321955919 CET | 22100 | 49793 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:23.502187967 CET | 22100 | 49793 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:27.164921045 CET | 49794 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:27.375230074 CET | 22100 | 49794 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:27.375329971 CET | 49794 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:27.403842926 CET | 49794 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:27.585500002 CET | 22100 | 49794 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:27.585692883 CET | 49794 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:27.613675117 CET | 22100 | 49794 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:27.796394110 CET | 22100 | 49794 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:31.383369923 CET | 49795 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:31.588234901 CET | 22100 | 49795 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:31.588548899 CET | 49795 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:31.617759943 CET | 49795 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:31.793629885 CET | 22100 | 49795 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:31.793699980 CET | 49795 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:31.822469950 CET | 22100 | 49795 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:32.001235008 CET | 22100 | 49795 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:36.117801905 CET | 49796 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:36.327759027 CET | 22100 | 49796 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:36.327874899 CET | 49796 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:36.350450993 CET | 49796 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:36.537683964 CET | 22100 | 49796 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:36.537754059 CET | 49796 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:36.560024023 CET | 22100 | 49796 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:36.568165064 CET | 49796 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:36.570010900 CET | 49797 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:36.747251034 CET | 22100 | 49796 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:36.777724028 CET | 22100 | 49796 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:36.786631107 CET | 22100 | 49797 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:36.786700964 CET | 49797 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:36.887695074 CET | 49797 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.003128052 CET | 22100 | 49797 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.003357887 CET | 49797 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.099524021 CET | 49797 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.101077080 CET | 49798 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.104032040 CET | 22100 | 49797 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.219733953 CET | 22100 | 49797 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.304599047 CET | 22100 | 49798 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.304815054 CET | 49798 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.315798998 CET | 22100 | 49797 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.334350109 CET | 49798 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.508378983 CET | 22100 | 49798 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.508544922 CET | 49798 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.537754059 CET | 22100 | 49798 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.552795887 CET | 49798 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.556843042 CET | 49799 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.712447882 CET | 22100 | 49798 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.756206036 CET | 22100 | 49798 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.764764071 CET | 22100 | 49799 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.768323898 CET | 49799 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.800740004 CET | 49799 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:37.976466894 CET | 22100 | 49799 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:37.976562977 CET | 49799 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:38.008565903 CET | 22100 | 49799 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:38.184345007 CET | 22100 | 49799 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:41.477933884 CET | 49800 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:41.687629938 CET | 22100 | 49800 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:41.687726974 CET | 49800 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:41.714230061 CET | 49800 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:41.897310019 CET | 22100 | 49800 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:41.897398949 CET | 49800 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:41.923628092 CET | 22100 | 49800 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:42.106899023 CET | 22100 | 49800 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:46.430648088 CET | 49801 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:46.637720108 CET | 22100 | 49801 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:46.637943983 CET | 49801 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:46.663614035 CET | 49801 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:46.845402956 CET | 22100 | 49801 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:46.845529079 CET | 49801 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:46.870446920 CET | 22100 | 49801 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:46.880994081 CET | 49801 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:46.882940054 CET | 49802 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.055243015 CET | 22100 | 49801 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.087394953 CET | 22100 | 49802 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.087472916 CET | 49802 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.088138103 CET | 22100 | 49801 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.140091896 CET | 49802 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.291394949 CET | 22100 | 49802 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.291562080 CET | 49802 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.344366074 CET | 22100 | 49802 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.349679947 CET | 49802 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.353545904 CET | 49803 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.495270014 CET | 22100 | 49802 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.553447008 CET | 22100 | 49802 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.564935923 CET | 22100 | 49803 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.565064907 CET | 49803 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.587018013 CET | 49803 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.776506901 CET | 22100 | 49803 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.777904034 CET | 49803 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.798261881 CET | 22100 | 49803 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:47.802741051 CET | 49803 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.804620028 CET | 49804 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:47.989283085 CET | 22100 | 49803 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.011179924 CET | 22100 | 49804 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.012254000 CET | 49804 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.013698101 CET | 22100 | 49803 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.091804028 CET | 49804 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.218796968 CET | 22100 | 49804 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.218887091 CET | 49804 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.299698114 CET | 22100 | 49804 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.302697897 CET | 49804 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.304768085 CET | 49805 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.425379992 CET | 22100 | 49804 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.510366917 CET | 22100 | 49804 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.522767067 CET | 22100 | 49805 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.522859097 CET | 49805 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.542541981 CET | 49805 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.739940882 CET | 22100 | 49805 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.740281105 CET | 49805 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:48.759179115 CET | 22100 | 49805 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:48.957032919 CET | 22100 | 49805 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:53.321589947 CET | 49806 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:53.537303925 CET | 22100 | 49806 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:53.537437916 CET | 49806 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:53.562444925 CET | 49806 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:53.753057957 CET | 22100 | 49806 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:53.753205061 CET | 49806 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:53.777832031 CET | 22100 | 49806 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:53.834372997 CET | 49806 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:53.836728096 CET | 49807 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:53.968743086 CET | 22100 | 49806 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.049707890 CET | 22100 | 49806 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.053369045 CET | 22100 | 49807 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.053704977 CET | 49807 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.072756052 CET | 49807 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.270667076 CET | 22100 | 49807 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.270730972 CET | 49807 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.289259911 CET | 22100 | 49807 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.349421978 CET | 49807 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.352027893 CET | 49808 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.487453938 CET | 22100 | 49807 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.560122967 CET | 22100 | 49808 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.560209990 CET | 49808 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.566185951 CET | 22100 | 49807 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.587162018 CET | 49808 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.768140078 CET | 22100 | 49808 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.768398046 CET | 49808 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:54.795006037 CET | 22100 | 49808 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:54.976299047 CET | 22100 | 49808 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:57.601547003 CET | 49809 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:57.811336040 CET | 22100 | 49809 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:57.811456919 CET | 49809 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:57.828943014 CET | 49809 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:58.021177053 CET | 22100 | 49809 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:58.021349907 CET | 49809 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:58.038255930 CET | 22100 | 49809 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:58.068484068 CET | 49809 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:58.070921898 CET | 49810 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:58.230791092 CET | 22100 | 49809 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:58.277966022 CET | 22100 | 49809 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:58.282354116 CET | 22100 | 49810 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:58.282474041 CET | 49810 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:58.306960106 CET | 49810 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:58.493947983 CET | 22100 | 49810 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:58.494019032 CET | 49810 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:36:58.518229961 CET | 22100 | 49810 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:36:58.705352068 CET | 22100 | 49810 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:01.497579098 CET | 49811 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:01.701636076 CET | 22100 | 49811 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:01.701836109 CET | 49811 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:01.723378897 CET | 49811 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:01.906230927 CET | 22100 | 49811 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:01.906400919 CET | 49811 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:01.927231073 CET | 22100 | 49811 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:02.110321999 CET | 22100 | 49811 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:03.681453943 CET | 49812 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:03.887351036 CET | 22100 | 49812 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:03.887609959 CET | 49812 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:03.914992094 CET | 49812 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:04.093744040 CET | 22100 | 49812 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:04.093955040 CET | 49812 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:04.099625111 CET | 49812 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:04.101871014 CET | 49813 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:04.121767998 CET | 22100 | 49812 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:04.303977966 CET | 22100 | 49812 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:04.309731960 CET | 22100 | 49812 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:04.310914993 CET | 22100 | 49813 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:04.311052084 CET | 49813 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:04.337517977 CET | 49813 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:04.518948078 CET | 22100 | 49813 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:04.519277096 CET | 49813 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:04.544281006 CET | 22100 | 49813 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:04.726880074 CET | 22100 | 49813 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:06.023330927 CET | 49814 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:06.234869957 CET | 22100 | 49814 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:06.235099077 CET | 49814 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:06.254278898 CET | 49814 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:06.446394920 CET | 22100 | 49814 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:06.446480036 CET | 49814 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:06.465548992 CET | 22100 | 49814 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:06.657599926 CET | 22100 | 49814 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:08.258447886 CET | 49815 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:08.474078894 CET | 22100 | 49815 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:08.474697113 CET | 49815 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:08.495474100 CET | 49815 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:08.690139055 CET | 22100 | 49815 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:08.690227032 CET | 49815 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:08.710757971 CET | 22100 | 49815 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:08.905726910 CET | 22100 | 49815 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:09.665561914 CET | 49816 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:09.871469021 CET | 22100 | 49816 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:09.871639967 CET | 49816 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:09.892899036 CET | 49816 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:10.077349901 CET | 22100 | 49816 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:10.077522039 CET | 49816 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:10.098330021 CET | 22100 | 49816 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:10.283201933 CET | 22100 | 49816 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:11.525893927 CET | 49817 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:11.731877089 CET | 22100 | 49817 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:11.732004881 CET | 49817 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:11.750195980 CET | 49817 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:11.937900066 CET | 22100 | 49817 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:11.940530062 CET | 49817 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:11.955959082 CET | 22100 | 49817 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:12.146229982 CET | 22100 | 49817 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:12.915920973 CET | 49818 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:13.127010107 CET | 22100 | 49818 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:13.127187967 CET | 49818 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:13.147612095 CET | 49818 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:13.338289976 CET | 22100 | 49818 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:13.338372946 CET | 49818 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:13.358419895 CET | 22100 | 49818 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:13.549145937 CET | 22100 | 49818 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:14.007730007 CET | 49819 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:14.214530945 CET | 22100 | 49819 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:14.217859983 CET | 49819 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:14.236377954 CET | 49819 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:14.424671888 CET | 22100 | 49819 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:14.429877043 CET | 49819 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:14.442766905 CET | 22100 | 49819 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:14.637799978 CET | 22100 | 49819 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:15.227756023 CET | 49820 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:15.445161104 CET | 22100 | 49820 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:15.445287943 CET | 49820 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:15.463844061 CET | 49820 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:15.662039995 CET | 22100 | 49820 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:15.665771961 CET | 49820 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:15.677654982 CET | 49820 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:15.680263042 CET | 22100 | 49820 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:15.682286024 CET | 49821 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:15.882297993 CET | 22100 | 49820 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:15.885817051 CET | 22100 | 49821 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:15.885966063 CET | 49821 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:15.893986940 CET | 22100 | 49820 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:15.905432940 CET | 49821 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:16.089679003 CET | 22100 | 49821 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:16.089766026 CET | 49821 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:16.108905077 CET | 22100 | 49821 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:16.293822050 CET | 22100 | 49821 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:16.852540970 CET | 49822 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:17.063616991 CET | 22100 | 49822 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:17.065906048 CET | 49822 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:17.083334923 CET | 49822 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:17.276932955 CET | 22100 | 49822 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:17.279875994 CET | 49822 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:17.294281960 CET | 22100 | 49822 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:17.490731955 CET | 22100 | 49822 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:17.790888071 CET | 49823 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:17.994805098 CET | 22100 | 49823 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:17.994913101 CET | 49823 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:18.023849010 CET | 49823 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:18.198817968 CET | 22100 | 49823 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:18.198951006 CET | 49823 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:18.227648020 CET | 22100 | 49823 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:18.402506113 CET | 22100 | 49823 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:18.665437937 CET | 49824 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:18.880172968 CET | 22100 | 49824 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:18.880260944 CET | 49824 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:18.902730942 CET | 49824 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:19.095067024 CET | 22100 | 49824 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:19.095238924 CET | 49824 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:19.117402077 CET | 22100 | 49824 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:19.310981035 CET | 22100 | 49824 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:19.392118931 CET | 49825 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:19.608941078 CET | 22100 | 49825 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:19.609105110 CET | 49825 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:19.628052950 CET | 49825 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:19.826112032 CET | 22100 | 49825 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:19.826183081 CET | 49825 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:19.844533920 CET | 22100 | 49825 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:20.042968035 CET | 22100 | 49825 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:20.141707897 CET | 49826 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:20.351049900 CET | 22100 | 49826 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:20.353759050 CET | 49826 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:20.371458054 CET | 49826 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:20.562901974 CET | 22100 | 49826 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:20.563059092 CET | 49826 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:20.580425978 CET | 22100 | 49826 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:20.772130013 CET | 22100 | 49826 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:20.794286966 CET | 49827 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.000386000 CET | 22100 | 49827 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.000484943 CET | 49827 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.018932104 CET | 49827 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.206720114 CET | 22100 | 49827 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.206794977 CET | 49827 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.224854946 CET | 22100 | 49827 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.351150990 CET | 49827 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.353866100 CET | 49828 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.412725925 CET | 22100 | 49827 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.557136059 CET | 22100 | 49827 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.557801962 CET | 22100 | 49828 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.561861992 CET | 49828 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.580009937 CET | 49828 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.765875101 CET | 22100 | 49828 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.769896984 CET | 49828 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:21.783972979 CET | 22100 | 49828 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.973740101 CET | 22100 | 49828 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:21.995743036 CET | 49829 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.205903053 CET | 22100 | 49829 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:22.205990076 CET | 49829 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.261054039 CET | 49829 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.416117907 CET | 22100 | 49829 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:22.417767048 CET | 49829 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.459747076 CET | 49829 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.463155985 CET | 49830 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.470839977 CET | 22100 | 49829 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:22.627989054 CET | 22100 | 49829 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:22.669579029 CET | 22100 | 49829 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:22.677949905 CET | 22100 | 49830 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:22.678167105 CET | 49830 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.697542906 CET | 49830 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.893831968 CET | 22100 | 49830 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:22.894048929 CET | 49830 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:22.912261963 CET | 22100 | 49830 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.037307978 CET | 49830 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.042855024 CET | 49831 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.108882904 CET | 22100 | 49830 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.252095938 CET | 22100 | 49830 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.259212017 CET | 22100 | 49831 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.259319067 CET | 49831 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.312845945 CET | 49831 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.475775957 CET | 22100 | 49831 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.475876093 CET | 49831 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.529453993 CET | 22100 | 49831 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.531797886 CET | 49831 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.538635015 CET | 49832 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.692116022 CET | 22100 | 49831 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.741902113 CET | 22100 | 49832 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.743838072 CET | 49832 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.748409033 CET | 22100 | 49831 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.786571980 CET | 49832 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.947185993 CET | 22100 | 49832 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:23.947273016 CET | 49832 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.963238001 CET | 49832 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.968255997 CET | 49833 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:23.989578009 CET | 22100 | 49832 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.150201082 CET | 22100 | 49832 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.166265011 CET | 22100 | 49832 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.175276041 CET | 22100 | 49833 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.175857067 CET | 49833 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.210484028 CET | 49833 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.384871006 CET | 22100 | 49833 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.384943008 CET | 49833 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.417543888 CET | 22100 | 49833 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.443880081 CET | 49833 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.447432041 CET | 49834 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.591826916 CET | 22100 | 49833 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.650764942 CET | 22100 | 49833 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.656954050 CET | 22100 | 49834 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.657099962 CET | 49834 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.682818890 CET | 49834 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.866605043 CET | 22100 | 49834 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.869786978 CET | 49834 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.879264116 CET | 49834 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:24.892127037 CET | 22100 | 49834 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.048413992 CET | 49835 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.079091072 CET | 22100 | 49834 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.088491917 CET | 22100 | 49834 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.265261889 CET | 22100 | 49835 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.265347958 CET | 49835 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.289880037 CET | 49835 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.482198000 CET | 22100 | 49835 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.482460022 CET | 49835 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.506194115 CET | 49835 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.506505966 CET | 22100 | 49835 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.510593891 CET | 49836 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.700480938 CET | 22100 | 49835 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.720730066 CET | 22100 | 49836 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.720829010 CET | 49836 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.723718882 CET | 22100 | 49835 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.741355896 CET | 49836 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.930568933 CET | 22100 | 49836 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:25.930634022 CET | 49836 | 22100 | 192.168.2.9 | 167.71.56.116 |
| Feb 6, 2024 09:37:25.950835943 CET | 22100 | 49836 | 167.71.56.116 | 192.168.2.9 |
| Feb 6, 2024 09:37:26.140152931 CET | 22100 | 49836 | 167.71.56.116 | 192.168.2.9 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Feb 6, 2024 09:33:26.793662071 CET | 54409 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:33:26.911106110 CET | 53 | 54409 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:33:27.982332945 CET | 57603 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:33:28.158396959 CET | 53 | 57603 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:34:08.804172993 CET | 52938 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:34:08.985332966 CET | 53 | 52938 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:34:41.040900946 CET | 53405 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:34:41.220263004 CET | 53 | 53405 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:35:11.273876905 CET | 55393 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:35:11.432729006 CET | 53 | 55393 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:36:06.174799919 CET | 65242 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:36:06.292565107 CET | 53 | 65242 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:36:11.480329037 CET | 64729 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:36:11.867438078 CET | 53 | 64729 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:36:35.960139990 CET | 64766 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:36:36.116210938 CET | 53 | 64766 | 1.1.1.1 | 192.168.2.9 |
| Feb 6, 2024 09:37:24.884151936 CET | 60452 | 53 | 192.168.2.9 | 1.1.1.1 |
| Feb 6, 2024 09:37:25.042890072 CET | 53 | 60452 | 1.1.1.1 | 192.168.2.9 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Feb 6, 2024 09:33:26.793662071 CET | 192.168.2.9 | 1.1.1.1 | 0x41bb | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:33:27.982332945 CET | 192.168.2.9 | 1.1.1.1 | 0xf2ba | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:34:08.804172993 CET | 192.168.2.9 | 1.1.1.1 | 0xccf0 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:34:41.040900946 CET | 192.168.2.9 | 1.1.1.1 | 0xa3d0 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:35:11.273876905 CET | 192.168.2.9 | 1.1.1.1 | 0x32e9 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:36:06.174799919 CET | 192.168.2.9 | 1.1.1.1 | 0xc776 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:36:11.480329037 CET | 192.168.2.9 | 1.1.1.1 | 0x60fb | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:36:35.960139990 CET | 192.168.2.9 | 1.1.1.1 | 0x8fbe | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 6, 2024 09:37:24.884151936 CET | 192.168.2.9 | 1.1.1.1 | 0x6556 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Feb 6, 2024 09:33:26.911106110 CET | 1.1.1.1 | 192.168.2.9 | 0x41bb | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:33:28.158396959 CET | 1.1.1.1 | 192.168.2.9 | 0xf2ba | No error (0) | eu-central-7075.packetriot.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Feb 6, 2024 09:33:28.158396959 CET | 1.1.1.1 | 192.168.2.9 | 0xf2ba | No error (0) | 167.71.56.116 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:34:08.985332966 CET | 1.1.1.1 | 192.168.2.9 | 0xccf0 | No error (0) | eu-central-7075.packetriot.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Feb 6, 2024 09:34:08.985332966 CET | 1.1.1.1 | 192.168.2.9 | 0xccf0 | No error (0) | 167.71.56.116 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:34:41.220263004 CET | 1.1.1.1 | 192.168.2.9 | 0xa3d0 | No error (0) | eu-central-7075.packetriot.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Feb 6, 2024 09:34:41.220263004 CET | 1.1.1.1 | 192.168.2.9 | 0xa3d0 | No error (0) | 167.71.56.116 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:35:11.432729006 CET | 1.1.1.1 | 192.168.2.9 | 0x32e9 | No error (0) | eu-central-7075.packetriot.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Feb 6, 2024 09:35:11.432729006 CET | 1.1.1.1 | 192.168.2.9 | 0x32e9 | No error (0) | 167.71.56.116 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:36:06.292565107 CET | 1.1.1.1 | 192.168.2.9 | 0xc776 | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:36:11.867438078 CET | 1.1.1.1 | 192.168.2.9 | 0x60fb | No error (0) | eu-central-7075.packetriot.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Feb 6, 2024 09:36:11.867438078 CET | 1.1.1.1 | 192.168.2.9 | 0x60fb | No error (0) | 167.71.56.116 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:36:36.116210938 CET | 1.1.1.1 | 192.168.2.9 | 0x8fbe | No error (0) | eu-central-7075.packetriot.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Feb 6, 2024 09:36:36.116210938 CET | 1.1.1.1 | 192.168.2.9 | 0x8fbe | No error (0) | 167.71.56.116 | A (IP address) | IN (0x0001) | false | ||
| Feb 6, 2024 09:37:25.042890072 CET | 1.1.1.1 | 192.168.2.9 | 0x6556 | No error (0) | eu-central-7075.packetriot.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Feb 6, 2024 09:37:25.042890072 CET | 1.1.1.1 | 192.168.2.9 | 0x6556 | No error (0) | 167.71.56.116 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.9 | 49705 | 149.154.167.220 | 443 | 3280 | C:\Users\user\AppData\Roaming\X.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-02-06 08:33:27 UTC | 447 | OUT | |
| 2024-02-06 08:33:27 UTC | 388 | IN | |
| 2024-02-06 08:33:27 UTC | 452 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.9 | 49784 | 149.154.167.220 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-02-06 08:36:06 UTC | 447 | OUT | |
| 2024-02-06 08:36:07 UTC | 388 | IN | |
| 2024-02-06 08:36:07 UTC | 452 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 09:33:19 |
| Start date: | 06/02/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7f0000 |
| File size: | 2'324'480 bytes |
| MD5 hash: | 8DCBB40394210DC5287028E66FDBF0C7 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 09:33:20 |
| Start date: | 06/02/2024 |
| Path: | C:\Users\user\AppData\Roaming\X.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x960000 |
| File size: | 36'864 bytes |
| MD5 hash: | F57EC853B0F01B0E9954CFBF8FEEB081 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 09:33:20 |
| Start date: | 06/02/2024 |
| Path: | C:\Users\user\AppData\Roaming\61c7cdb3196df.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1'907'200 bytes |
| MD5 hash: | C0E5B07CBF2D02C54F39CE6AAD676DC7 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 09:33:24 |
| Start date: | 06/02/2024 |
| Path: | C:\Windows\System32\schtasks.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6c27f0000 |
| File size: | 235'008 bytes |
| MD5 hash: | 76CD6626DD8834BD4A42E6A565104DC2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 09:33:24 |
| Start date: | 06/02/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff70f010000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 16 |
| Start time: | 09:35:34 |
| Start date: | 06/02/2024 |
| Path: | C:\Windows\System32\svchost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff77afe0000 |
| File size: | 55'320 bytes |
| MD5 hash: | B7F884C1B74A263F746EE12A5F7C9F6A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 17 |
| Start time: | 09:35:35 |
| Start date: | 06/02/2024 |
| Path: | C:\Windows\System32\WerFault.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6d9200000 |
| File size: | 570'736 bytes |
| MD5 hash: | FD27D9F6D02763BDE32511B5DF7FF7A0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 18 |
| Start time: | 09:35:35 |
| Start date: | 06/02/2024 |
| Path: | C:\Windows\System32\WerFault.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6d9200000 |
| File size: | 570'736 bytes |
| MD5 hash: | FD27D9F6D02763BDE32511B5DF7FF7A0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 19 |
| Start time: | 09:35:38 |
| Start date: | 06/02/2024 |
| Path: | C:\Windows\System32\svchost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff77afe0000 |
| File size: | 55'320 bytes |
| MD5 hash: | B7F884C1B74A263F746EE12A5F7C9F6A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880C10ED Relevance: .4, Instructions: 431COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880C09F7 Relevance: .2, Instructions: 220COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880C0498 Relevance: .1, Instructions: 91COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880C0E71 Relevance: .1, Instructions: 51COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880C04B0 Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880C04A8 Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880C0F3F Relevance: .0, Instructions: 30COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D65A6 Relevance: .5, Instructions: 471COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D7352 Relevance: .5, Instructions: 457COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D17F5 Relevance: .2, Instructions: 198COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D6F66 Relevance: .3, Instructions: 330COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D0590 Relevance: .2, Instructions: 234COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880DB0AD Relevance: .2, Instructions: 215COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D9D89 Relevance: .2, Instructions: 203COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D9170 Relevance: .2, Instructions: 200COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D3A8C Relevance: .2, Instructions: 194COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D89D2 Relevance: .2, Instructions: 184COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D0C0E Relevance: .2, Instructions: 152COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D7C71 Relevance: .1, Instructions: 143COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D04D0 Relevance: .1, Instructions: 139COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880DA062 Relevance: .1, Instructions: 125COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D0AA9 Relevance: .1, Instructions: 121COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D7CA0 Relevance: .1, Instructions: 121COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D0AC0 Relevance: .1, Instructions: 113COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D096D Relevance: .1, Instructions: 112COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D9543 Relevance: .1, Instructions: 109COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D9664 Relevance: .1, Instructions: 100COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880DB4B5 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D6A64 Relevance: .1, Instructions: 92COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D9248 Relevance: .1, Instructions: 87COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D8A62 Relevance: .1, Instructions: 82COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D7B61 Relevance: .1, Instructions: 81COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880DB3D9 Relevance: .1, Instructions: 80COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D9FA9 Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880DB2C1 Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D7B80 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D0760 Relevance: .1, Instructions: 66COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D1E1D Relevance: .1, Instructions: 61COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D8E51 Relevance: .0, Instructions: 48COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D19B1 Relevance: .0, Instructions: 46COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D1E40 Relevance: .0, Instructions: 46COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D2371 Relevance: .0, Instructions: 42COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D7DBC Relevance: .0, Instructions: 30COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF8880D0765 Relevance: .0, Instructions: 10COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |