Edit tour

Windows Analysis Report
kz7iLmqRuq.exe

Overview

General Information

Sample name:	kz7iLmqRuq.exe renamed because original name is a hash value
Original sample name:	4ebd63449193b8fdbd0c0315f8e33e10.exe
Analysis ID:	1477111
MD5:	4ebd63449193b8fdbd0c0315f8e33e10
SHA1:	31d7b7aee638dfdbfb2e2f009d27ad30637f5953
SHA256:	7d21bbbcb3e0f709dd351c1edc4d52efae8da0edf341121c17a6cfb1a9ecc7b2
Tags:	32exe
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Drops PE files with benign system names

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: System File Execution Location Anomaly

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Connects to several IPs in different countries

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

kz7iLmqRuq.exe (PID: 4508 cmdline: "C:\Users\user\Desktop\kz7iLmqRuq.exe" MD5: 4EBD63449193B8FDBD0C0315F8E33E10)

schtasks.exe (PID: 6616 cmdline: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 792 cmdline: "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5452 cmdline: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" MD5: 4EBD63449193B8FDBD0C0315F8E33E10)

schtasks.exe (PID: 6604 cmdline: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 2760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6612 cmdline: "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

kz7iLmqRuq.exe (PID: 4220 cmdline: C:\Users\user\Desktop\kz7iLmqRuq.exe MD5: 4EBD63449193B8FDBD0C0315F8E33E10)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.0", "Host:Port": "45.66.231.154:45764;", "SubDirectory": "Microsoft Windows", "InstallName": "svchost.exe", "MutexName": "80038a66-0dbb-4135-8eb1-4ce5a34ce41b", "StartupKey": "svchost", "Tag": "Proxy", "LogDirectoryName": "svchostetw", "ServerSignature": "DBA8F0Br++WlVnwMY+TOW3OLUcEzXGeCEpOjr8WUkG+2zCAq/kjzFN0ynUG7fVZJ2WnLgRMFCsnq+tQUyVRlD2d5OlDSd/89AGgSVE2v9+GKNyc798YKw+I8C5fQOSMPFpDgKf5dKMZdCkGYH88RdlMVn+P2IZysmei7aIdaN6ozqMBSJ3dYDd32Gz/nEv0PfLO8IH2gEmckMn0ox5+a1nQqWprOyOIvEwmwXM4zUb60JA3vXdZgUOqa8bXTE61J00WpLHW7n+ovTcw9xf6BrZayMnbNSF4c43JzJg8GPjLxCYEz4+4yc+T8TMveGuOTcMBoF6oh/rl43wMyyUWF6AqFMjQumJfK27M9e/Wt6/eym/Ny3Os3EA4F8rQjOEXaXg1n6VwK673sq38YoOFcOxJoBi7dwGCJ4nzNfFDgie/wOGhfen9yfDxk9+TXmKq2vsVjbElYLuFTnj/97F0vhIy6r4GoJyckl6ueQ89BUx5BJZuxY+Ne9C7v0qRhPNAasRpGjp/+Z9bQOvzTJKp1qFsQjtBRVxBycTB1ot1jg1jEBnZ/Iz+gT1GqQTeJ0vvsFjJcm7PwI3lJ+lzd9fhixiWe77RTDl8B4sDgf6+1WkUd//2uAnhNIJt81NkDMmmpjYbygCBOnGGY4qyqKgDsTtS+QZS1vUCgN8VZTlofKZY=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMfljgRljIw8eG6/KAHpETANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDcwOTE5MTA0OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhkNgzYkaEwf7PBmR34/tzDkjeq0EJR6st02BJKB6Pn0eymJW5ztCKBjJWcj7ostsw1a8yLjTRhlPG2yTbAptsqGR7yW4Vx5EcTnJN1gnpbsHwMV0Nt46dJUsXGzDmSnMeazOYj9kusu/ppQkNYizfvV4De9PrDSyr/buwR4wWMZ/VpIW4LYCSKfrR/MhCV+RoWrr9hEYAw239t3sCQxo1aXlje5PyfqMXfjsHpecZazN08hwj3Rt08LVr3X8PZAn+mEqltOhyp+dEbQYK8S/2DYVp5OrTrRSrbY8cl06nAKMAPXobfLQ1yn9CnlwMUyV+B7GU0wWCK0JsUrfczniucg4bAGnQY+fAwnmM4LT/5T6wZlBgJABkyRW02Vi7vKtU+FQTpBq7lWVZIc5zJXgavwJl+WF7xwdNG/aiDItl2gZ7AqhS6zXo6+jmYUt1Tz5NgVjxtEZPEZ3SmMWYIYmBN4De8cP6wdv70w0csE65l3eyOpTf6Ez24x14kqk+dBzn3DH/wSSW6Y3XY/Fx3TL596pw+rOCD9OQx5SkYwEm39k3LZxvPSkbXrGTemBi12Khp23CypLECFMNYooDz+/5pLVwrRqkXEqaHYpeQ3F0uYlJwzlWVGZRtSg1vKkfrsR3f9/zaEvwMhhjx/xf+qXBvHkqEav9yJKYF8FI+Vf0jcCAwEAAaMyMDAwHQYDVR0OBBYEFPZB8zAaPEqcMz49Nz1nOdAlp926MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAAAxAkkSUk3Kt0Auf6XkCxIqotC09vm7t3YkEiQXeEA6YUTSBorR9g1WMAqxBQys9A5TFGUEOukXrVVpTljXKiWo5FzVptTd+dXTgu+KmhVEOobIaAiXvyccvRZcv6b/+bvG6Mag7bU8+hxwMHpne2DbOHO9ediM8FPK0uNEvQbYjJczQEOzJBdUQt4tNEn9vzJNH5a4JF1MJ0FAYR7B7gjuC+7jgFIrjioNyWfF0WktB38DGWxYKwl5kvq0KoZdwrNPlm2cceBnf9fHSyvRjfCbQXZ+voLsp2O9QAKYxy3zrLGsLZ313jI0h9pwySVxI+Pv7LYcBnJbg6843wjV3Sp13KUJDn944Nzxkwy76VOTCtb+/lZg3xZ5H1c1AlHlP0WqfpQV+L97HOO+PYBDKNGfU/ZcsQfUdWfboIueM85bxeIIjbhIn471OrVUCs13j67bSGtZkhpuhd2jyfiEU5koRWFPQZjEt7vbfAHFRh6mnFk1B4Jm7yZK3VHd360QFwEc6EKxQ18kh6TEK15D7l+/oUd3uIOM/WqkQzfW2QVkL943vW1pzaobeM3lcoOXVMV1dFnyXOi8/u/0++oc9vRjwLY6RvHGGqjTIWRsO1ULsoaMi7o9NtHE+vfDYe+f3+4TYlBB7Z+WpQc6lCqgFk/aZnoR0tYWs2gd1G23+691"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
kz7iLmqRuq.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
kz7iLmqRuq.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
kz7iLmqRuq.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x258ad0:$x1: Quasar.Common.Messages 0x267cb0:$x1: Quasar.Common.Messages 0x27471d:$x4: Uninstalling... good bye :-( 0x275e42:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
kz7iLmqRuq.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x273ccf:$f1: FileZilla\recentservers.xml 0x273d0f:$f2: FileZilla\sitemanager.xml 0x273d51:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x273f9d:$b1: Chrome\User Data\ 0x273ff3:$b1: Chrome\User Data\ 0x2742cb:$b2: Mozilla\Firefox\Profiles 0x2743c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2c6531:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x27451f:$b4: Opera Software\Opera Stable\Login Data 0x2745d9:$b5: YandexBrowser\User Data\ 0x274647:$b5: YandexBrowser\User Data\ 0x27431b:$s4: logins.json 0x274051:$a1: username_value 0x27406f:$a2: password_value 0x27435b:$a3: encryptedUsername 0x2c6475:$a3: encryptedUsername 0x27437f:$a4: encryptedPassword 0x2c6493:$a4: encryptedPassword 0x2c6411:$a5: httpRealm
kz7iLmqRuq.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x1468cf:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x1469c1:$s2: DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null 0x274807:$s3: Process already elevated. 0x2587f3:$s4: get_PotentiallyVulnerablePasswords 0x244619:$s5: GetKeyloggerLogsDirectory 0x2674c3:$s5: GetKeyloggerLogsDirectory 0x258816:$s6: set_PotentiallyVulnerablePasswords 0x2c7c32:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x258ad0:$x1: Quasar.Common.Messages 0x267cb0:$x1: Quasar.Common.Messages 0x27471d:$x4: Uninstalling... good bye :-( 0x275e42:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x273ccf:$f1: FileZilla\recentservers.xml 0x273d0f:$f2: FileZilla\sitemanager.xml 0x273d51:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x273f9d:$b1: Chrome\User Data\ 0x273ff3:$b1: Chrome\User Data\ 0x2742cb:$b2: Mozilla\Firefox\Profiles 0x2743c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2c6531:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x27451f:$b4: Opera Software\Opera Stable\Login Data 0x2745d9:$b5: YandexBrowser\User Data\ 0x274647:$b5: YandexBrowser\User Data\ 0x27431b:$s4: logins.json 0x274051:$a1: username_value 0x27406f:$a2: password_value 0x27435b:$a3: encryptedUsername 0x2c6475:$a3: encryptedUsername 0x27437f:$a4: encryptedPassword 0x2c6493:$a4: encryptedPassword 0x2c6411:$a5: httpRealm
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x1468cf:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x1469c1:$s2: DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null 0x274807:$s3: Process already elevated. 0x2587f3:$s4: get_PotentiallyVulnerablePasswords 0x244619:$s5: GetKeyloggerLogsDirectory 0x2674c3:$s5: GetKeyloggerLogsDirectory 0x258816:$s6: set_PotentiallyVulnerablePasswords 0x2c7c32:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1234830899.0000000000FA2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1262889498.000000001BFE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: kz7iLmqRuq.exe PID: 4508	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: svchost.exe PID: 5452	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.kz7iLmqRuq.exe.fa0000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.kz7iLmqRuq.exe.fa0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.kz7iLmqRuq.exe.fa0000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x258ad0:$x1: Quasar.Common.Messages 0x267cb0:$x1: Quasar.Common.Messages 0x27471d:$x4: Uninstalling... good bye :-( 0x275e42:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.kz7iLmqRuq.exe.fa0000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x273ccf:$f1: FileZilla\recentservers.xml 0x273d0f:$f2: FileZilla\sitemanager.xml 0x273d51:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x273f9d:$b1: Chrome\User Data\ 0x273ff3:$b1: Chrome\User Data\ 0x2742cb:$b2: Mozilla\Firefox\Profiles 0x2743c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2c6531:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x27451f:$b4: Opera Software\Opera Stable\Login Data 0x2745d9:$b5: YandexBrowser\User Data\ 0x274647:$b5: YandexBrowser\User Data\ 0x27431b:$s4: logins.json 0x274051:$a1: username_value 0x27406f:$a2: password_value 0x27435b:$a3: encryptedUsername 0x2c6475:$a3: encryptedUsername 0x27437f:$a4: encryptedPassword 0x2c6493:$a4: encryptedPassword 0x2c6411:$a5: httpRealm
0.0.kz7iLmqRuq.exe.fa0000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x1468cf:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x1469c1:$s2: DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null 0x274807:$s3: Process already elevated. 0x2587f3:$s4: get_PotentiallyVulnerablePasswords 0x244619:$s5: GetKeyloggerLogsDirectory 0x2674c3:$s5: GetKeyloggerLogsDirectory 0x258816:$s6: set_PotentiallyVulnerablePasswords 0x2c7c32:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\kz7iLmqRuq.exe, ProcessId: 4508, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.201, DestinationIsIpv6: false, DestinationPort: 4444, EventID: 3, Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Initiated: true, ProcessId: 5452, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49825

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\kz7iLmqRuq.exe", ParentImage: C:\Users\user\Desktop\kz7iLmqRuq.exe, ParentProcessId: 4508, ParentProcessName: kz7iLmqRuq.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", ProcessId: 5452, ProcessName: svchost.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 47.254.36.213, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Initiated: true, ProcessId: 5452, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", ParentImage: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, ParentProcessId: 5452, ParentProcessName: svchost.exe, ProcessCommandLine: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f, ProcessId: 6604, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\kz7iLmqRuq.exe", ParentImage: C:\Users\user\Desktop\kz7iLmqRuq.exe, ParentProcessId: 4508, ParentProcessName: kz7iLmqRuq.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", ProcessId: 5452, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\kz7iLmqRuq.exe", ParentImage: C:\Users\user\Desktop\kz7iLmqRuq.exe, ParentProcessId: 4508, ParentProcessName: kz7iLmqRuq.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", ProcessId: 5452, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\kz7iLmqRuq.exe", ParentImage: C:\Users\user\Desktop\kz7iLmqRuq.exe, ParentProcessId: 4508, ParentProcessName: kz7iLmqRuq.exe, ProcessCommandLine: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f, ProcessId: 6616, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 70.166.167.38 - Destination IP: 192.168.2.7

Timestamp:	07/20/24-02:24:18.744560
SID:	2035595
Source Port:	57728
Destination Port:	49943
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kz7iLmqRuq.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Avira: detection malicious, Label: HEUR/AGEN.1307418

Found malware configuration

Source: kz7iLmqRuq.exe

Malware Configuration Extractor: Quasar {"Version": "1.4.0", "Host:Port": "45.66.231.154:45764;", "SubDirectory": "Microsoft Windows", "InstallName": "svchost.exe", "MutexName": "80038a66-0dbb-4135-8eb1-4ce5a34ce41b", "StartupKey": "svchost", "Tag": "Proxy", "LogDirectoryName": "svchostetw", "ServerSignature": "DBA8F0Br++WlVnwMY+TOW3OLUcEzXGeCEpOjr8WUkG+2zCAq/kjzFN0ynUG7fVZJ2WnLgRMFCsnq+tQUyVRlD2d5OlDSd/89AGgSVE2v9+GKNyc798YKw+I8C5fQOSMPFpDgKf5dKMZdCkGYH88RdlMVn+P2IZysmei7aIdaN6ozqMBSJ3dYDd32Gz/nEv0PfLO8IH2gEmckMn0ox5+a1nQqWprOyOIvEwmwXM4zUb60JA3vXdZgUOqa8bXTE61J00WpLHW7n+ovTcw9xf6BrZayMnbNSF4c43JzJg8GPjLxCYEz4+4yc+T8TMveGuOTcMBoF6oh/rl43wMyyUWF6AqFMjQumJfK27M9e/Wt6/eym/Ny3Os3EA4F8rQjOEXaXg1n6VwK673sq38YoOFcOxJoBi7dwGCJ4nzNfFDgie/wOGhfen9yfDxk9+TXmKq2vsVjbElYLuFTnj/97F0vhIy6r4GoJyckl6ueQ89BUx5BJZuxY+Ne9C7v0qRhPNAasRpGjp/+Z9bQOvzTJKp1qFsQjtBRVxBycTB1ot1jg1jEBnZ/Iz+gT1GqQTeJ0vvsFjJcm7PwI3lJ+lzd9fhixiWe77RTDl8B4sDgf6+1WkUd//2uAnhNIJt81NkDMmmpjYbygCBOnGGY4qyqKgDsTtS+QZS1vUCgN8VZTlofKZY=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMfljgRljIw8eG6/KAHpETANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDcwOTE5MTA0OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhkNgzYkaEwf7PBmR34/tzDkjeq0EJR6st02BJKB6Pn0eymJW5ztCKBjJWcj7ostsw1a8yLjTRhlPG2yTbAptsqGR7yW4Vx5EcTnJN1gnpbsHwMV0Nt46dJUsXGzDmSnMeazOYj9kusu/ppQkNYizfvV4De9PrDSyr/buwR4wWMZ/VpIW4LYCSKfrR/MhCV+RoWrr9hEYAw239t3sCQxo1aXlje5PyfqMXfjsHpecZazN08hwj3Rt08LVr3X8PZAn+mEqltOhyp+dEbQYK8S/2DYVp5OrTrRSrbY8cl06nAKMAPXobfLQ1yn9CnlwMUyV+B7GU0wWCK0JsUrfczniucg4bAGnQY+fAwnmM4LT/5T6wZlBgJABkyRW02Vi7vKtU+FQTpBq7lWVZIc5zJXgavwJl+WF7xwdNG/aiDItl2gZ7AqhS6zXo6+jmYUt1Tz5NgVjxtEZPEZ3SmMWYIYmBN4De8cP6wdv70w0csE65l3eyOpTf6Ez24x14kqk+dBzn3DH/wSSW6Y3XY/Fx3TL596pw+rOCD9OQx5SkYwEm39k3LZxvPSkbXrGTemBi12Khp23CypLECFMNYooDz+/5pLVwrRqkXEqaHYpeQ3F0uYlJwzlWVGZRtSg1vKkfrsR3f9/zaEvwMhhjx/xf+qXBvHkqEav9yJKYF8FI+Vf0jcCAwEAAaMyMDAwHQYDVR0OBBYEFPZB8zAaPEqcMz49Nz1nOdAlp926MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAAAxAkkSUk3Kt0Auf6XkCxIqotC09vm7t3YkEiQXeEA6YUTSBorR9g1WMAqxBQys9A5TFGUEOukXrVVpTljXKiWo5FzVptTd+dXTgu+KmhVEOobIaAiXvyccvRZcv6b/+bvG6Mag7bU8+hxwMHpne2DbOHO9ediM8FPK0uNEvQbYjJczQEOzJBdUQt4tNEn9vzJNH5a4JF1MJ0FAYR7B7gjuC+7jgFIrjioNyWfF0WktB38DGWxYKwl5kvq0KoZdwrNPlm2cceBnf9fHSyvRjfCbQXZ+voLsp2O9QAKYxy3zrLGsLZ313jI0h9pwySVxI+Pv7LYcBnJbg6843wjV3Sp13KUJDn944Nzxkwy76VOTCtb+/lZg3xZ5H1c1AlHlP0WqfpQV+L97HOO+PYBDKNGfU/ZcsQfUdWfboIueM85bxeIIjbhIn471OrVUCs13j67bSGtZkhpuhd2jyfiEU5koRWFPQZjEt7vbfAHFRh6mnFk1B4Jm7yZK3VHd360QFwEc6EKxQ18kh6TEK15D7l+/oUd3uIOM/WqkQzfW2QVkL943vW1pzaobeM3lcoOXVMV1dFnyXOi8/u/0++oc9vRjwLY6RvHGGqjTIWRsO1ULsoaMi7o9NtHE+vfDYe+f3+4TYlBB7Z+WpQc6lCqgFk/aZnoR0tYWs2gd1G23+691"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Virustotal: Detection: 75%			Perma Link

Multi AV Scanner detection for submitted file

Source: kz7iLmqRuq.exe	ReversingLabs: Detection: 78%
Source: kz7iLmqRuq.exe	Virustotal: Detection: 75%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: kz7iLmqRuq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1234830899.0000000000FA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1262889498.000000001BFE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kz7iLmqRuq.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: kz7iLmqRuq.exe

Joe Sandbox ML: detected

Source: kz7iLmqRuq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.18.11.5:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.172.148.96:443 -> 192.168.2.7:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49948 version: TLS 1.2

Source: kz7iLmqRuq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 70.166.167.38:57728 -> 192.168.2.7:49943

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.220.141.8 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 34.124.190.108 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.251.87.199 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 193.143.1.201 4444	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 196.43.106.62 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.178.172.3 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.81.117.225 4153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 39.101.65.228 6000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.170 24447	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.210 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.43.227.226 1865	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.172 20679	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.102.106.94 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 155.254.9.107 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 183.6.7.103 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 201.221.134.74 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.213 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.126.86.78 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.129.145 16894	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 1.179.148.33 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 36.95.13.18 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.252.208.70 14282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.104.87.23 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.87.81.86 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.8.94.174 39078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 154.12.253.232 41739	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 14.225.62.76 6666	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.172.148.96 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 197.234.58.102 32767	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 83.235.22.245 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.37.216.68 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.206 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.0.235.197 12139	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 51.81.31.64 15062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 92.205.108.94 40994	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.253.153.242 41762	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.54.67 8800	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 189.175.197.223 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 39.100.88.89 3128	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 78.133.163.190 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.8.84.3 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 135.148.139.151 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.122.56.158 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 5.22.154.50 60606	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.238.128.246 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.104.28.135 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 102.219.33.118 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 85.206.167.133 32631	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.96.97.202 4153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 64.124.191.98 32688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 77.64.42.173 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.141.233.168 1287	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 188.173.14.99 36835	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 139.180.169.114 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 137.141.148.79 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.116.210.163 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 23.105.170.33 38930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 168.227.158.65 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 213.16.81.182 35559	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 24.249.199.4 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 74.119.147.209 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 50.250.205.21 32100	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 189.201.191.18 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.18.11.5 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 109.120.222.90 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 24.249.199.12 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.122.60.157 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.200.152.30 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.233.238.6 3373	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.180.90.88 16002	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 98.170.57.231 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.12.95.170 37209	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 94.23.220.136 59415	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 76.26.105.162 8833	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.252.20.42 10243	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.85.157.25 4153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 114.215.127.92 8118	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.239.80.124 570	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 196.216.13.36 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 203.96.177.211 57070	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.104.27.165 3128	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.174.178.147 2454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.180.88.173 6453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 70.166.167.38 57728	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.211.195.173 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.187.210.54 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 95.111.227.164 45028	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 66.23.233.210 62979	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 93.158.155.18 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 91.247.92.63 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 195.154.43.198 15722	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 68.1.210.163 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 98.170.57.249 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.116.114.11 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.213.212.129 58535	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 161.97.163.52 61912	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.238.100.115 45314	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.251.87.74 9080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.254.36.213 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.252.220.92 17328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 181.214.152.204 1628	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 35.185.195.201 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 85.89.184.87 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.38.245.106 55713	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 202.69.38.42 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.234.100.102 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 147.124.212.31 8259	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.39.117 9090	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.26.13.205 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.216.204.146 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 94.131.7.1 31287	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 115.73.130.122 24093	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 181.143.106.162 59391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 46.231.72.35 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 173.212.205.144 62909	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.210.252.137 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.137.34 18765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 142.166.131.50 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.137.35 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.195.114.169 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.108.84.168 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.90 20347	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.213.215.187 3128	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 189.226.237.127 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.170.249.65 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 98.103.88.158 46104	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 70.166.167.55 57745	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 132.148.167.243 53197	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.55.87.48 5566	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.168.121.153 44909	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.66.231.154

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 8.220.141.8 ports 8081,1,2,3,3128,8
Source: global traffic	TCP traffic: 207.244.255.174 ports 1,2,4,8,9,14289
Source: global traffic	TCP traffic: 198.8.94.174 ports 39078,0,3,7,8,9
Source: global traffic	TCP traffic: 91.150.77.57 ports 1,2,56921,5,6,9
Source: global traffic	TCP traffic: 51.81.31.64 ports 15062,0,1,2,5,6
Source: global traffic	TCP traffic: 103.253.153.242 ports 41762,1,2,4,6,7
Source: global traffic	TCP traffic: 67.43.228.253 ports 0,1,10769,6,7,9
Source: global traffic	TCP traffic: 198.12.253.239 ports 0,2,3,8,9,39820
Source: global traffic	TCP traffic: 94.23.220.136 ports 1,59415,4,5,9,56714
Source: global traffic	TCP traffic: 107.180.88.173 ports 6453,61358,1,3,5,6,8
Source: global traffic	TCP traffic: 207.244.229.34 ports 59076,0,5,6,7,9
Source: global traffic	TCP traffic: 77.65.50.118 ports 1,3,34159,4,5,9
Source: global traffic	TCP traffic: 94.131.7.1 ports 21597,1,2,3,31287,31991,7,8
Source: global traffic	TCP traffic: 162.214.154.141 ports 1,3,4,5,8,43581
Source: global traffic	TCP traffic: 72.10.160.90 ports 20347,0,2,3,4,7
Source: global traffic	TCP traffic: 132.148.167.243 ports 1,3,53197,5,7,9
Source: global traffic	TCP traffic: 1.179.151.165 ports 1,3,4,8,9,31948
Source: global traffic	TCP traffic: 72.10.160.170 ports 24447,0,1,3,7,31703
Source: global traffic	TCP traffic: 72.10.160.172 ports 20679,0,2,6,7,13697,9
Source: global traffic	TCP traffic: 154.12.253.232 ports 1,3,41739,4,7,9
Source: global traffic	TCP traffic: 45.124.84.110 ports 15473,1,3,4,5,7
Source: global traffic	TCP traffic: 138.255.240.66 ports 40736,0,3,4,6,7
Source: global traffic	TCP traffic: 190.12.95.170 ports 0,2,3,7,9,37209
Source: global traffic	TCP traffic: 47.252.20.42 ports 0,1,2,3,4,10243
Source: global traffic	TCP traffic: 178.255.44.62 ports 0,2,3,5,6,26530
Source: global traffic	TCP traffic: 162.214.227.68 ports 0,1,5,6,51069,9
Source: global traffic	TCP traffic: 170.244.64.12 ports 31476,1,3,4,6,7
Source: global traffic	TCP traffic: 95.111.227.164 ports 45028,0,2,4,5,8
Source: global traffic	TCP traffic: 166.62.88.163 ports 14827,1,2,4,7,8
Source: global traffic	TCP traffic: 162.214.121.173 ports 44826,61359,1,3,5,6,9
Source: global traffic	TCP traffic: 115.73.130.122 ports 0,24093,2,3,4,9
Source: global traffic	TCP traffic: 45.89.19.85 ports 15397,1,3,5,7,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 10709 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 23988 -> 49882

Yara detected Generic Downloader

Source: Yara match	File source: kz7iLmqRuq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED

Source: unknown

Network traffic detected: IP country count 32

Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 23.105.170.33:38930
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 190.12.95.170:37209
Source: global traffic	TCP traffic: 192.168.2.7:49713 -> 132.148.167.243:53197
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 198.8.94.174:39078
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 199.116.114.11:4145
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 184.181.217.213:4145
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 51.81.31.64:15062
Source: global traffic	TCP traffic: 192.168.2.7:49707 -> 109.120.222.90:1080
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 177.104.87.23:5678
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 195.154.43.198:15722
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 98.103.88.158:46104
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 115.73.130.122:24093
Source: global traffic	TCP traffic: 192.168.2.7:49711 -> 173.212.205.144:62909
Source: global traffic	TCP traffic: 192.168.2.7:49712 -> 177.85.157.25:4153
Source: global traffic	TCP traffic: 192.168.2.7:49714 -> 85.89.184.87:5678
Source: global traffic	TCP traffic: 192.168.2.7:49715 -> 1.179.148.33:1080
Source: global traffic	TCP traffic: 192.168.2.7:49716 -> 46.231.72.35:5678
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 199.233.238.6:3373
Source: global traffic	TCP traffic: 192.168.2.7:49718 -> 95.111.227.164:45028
Source: global traffic	TCP traffic: 192.168.2.7:49719 -> 188.173.14.99:36835
Source: global traffic	TCP traffic: 192.168.2.7:49720 -> 190.108.84.168:4145
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 147.124.212.31:8259
Source: global traffic	TCP traffic: 192.168.2.7:49722 -> 168.227.158.65:4145
Source: global traffic	TCP traffic: 192.168.2.7:49723 -> 161.97.163.52:61912
Source: global traffic	TCP traffic: 192.168.2.7:49724 -> 72.10.160.170:31703
Source: global traffic	TCP traffic: 192.168.2.7:49725 -> 72.10.160.90:20347
Source: global traffic	TCP traffic: 192.168.2.7:49726 -> 103.87.81.86:5678
Source: global traffic	TCP traffic: 192.168.2.7:49727 -> 154.12.253.232:41739
Source: global traffic	TCP traffic: 192.168.2.7:49728 -> 47.252.20.42:10243
Source: global traffic	TCP traffic: 192.168.2.7:49729 -> 83.235.22.245:5678
Source: global traffic	TCP traffic: 192.168.2.7:49730 -> 47.254.36.213:8080
Source: global traffic	TCP traffic: 192.168.2.7:49731 -> 202.69.38.42:5678
Source: global traffic	TCP traffic: 192.168.2.7:49732 -> 162.216.204.146:1080
Source: global traffic	TCP traffic: 192.168.2.7:49733 -> 8.220.141.8:3128
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 98.170.57.231:4145
Source: global traffic	TCP traffic: 192.168.2.7:49735 -> 103.81.117.225:4153
Source: global traffic	TCP traffic: 192.168.2.7:49737 -> 34.124.190.108:8080
Source: global traffic	TCP traffic: 192.168.2.7:49738 -> 67.213.212.129:58535
Source: global traffic	TCP traffic: 192.168.2.7:49739 -> 76.26.105.162:8833
Source: global traffic	TCP traffic: 192.168.2.7:49740 -> 139.180.169.114:8080
Source: global traffic	TCP traffic: 192.168.2.7:49741 -> 199.102.106.94:4145
Source: global traffic	TCP traffic: 192.168.2.7:49742 -> 98.170.57.249:4145
Source: global traffic	TCP traffic: 192.168.2.7:49743 -> 189.201.191.18:4145
Source: global traffic	TCP traffic: 192.168.2.7:49744 -> 184.181.217.210:4145
Source: global traffic	TCP traffic: 192.168.2.7:49746 -> 184.178.172.3:4145
Source: global traffic	TCP traffic: 192.168.2.7:49747 -> 72.195.114.169:4145
Source: global traffic	TCP traffic: 192.168.2.7:49748 -> 174.141.233.168:1287
Source: global traffic	TCP traffic: 192.168.2.7:49749 -> 94.23.220.136:59415
Source: global traffic	TCP traffic: 192.168.2.7:49750 -> 104.239.80.124:570
Source: global traffic	TCP traffic: 192.168.2.7:49751 -> 64.124.191.98:32688
Source: global traffic	TCP traffic: 192.168.2.7:49753 -> 5.22.154.50:60606
Source: global traffic	TCP traffic: 192.168.2.7:49754 -> 74.119.147.209:4145
Source: global traffic	TCP traffic: 192.168.2.7:49756 -> 70.166.167.38:57728
Source: global traffic	TCP traffic: 192.168.2.7:49757 -> 14.225.62.76:6666
Source: global traffic	TCP traffic: 192.168.2.7:49758 -> 104.238.100.115:45314
Source: global traffic	TCP traffic: 192.168.2.7:49759 -> 72.10.160.172:20679
Source: global traffic	TCP traffic: 192.168.2.7:49760 -> 66.23.233.210:62979
Source: global traffic	TCP traffic: 192.168.2.7:49762 -> 39.100.88.89:8080
Source: global traffic	TCP traffic: 192.168.2.7:49765 -> 197.234.58.102:32767
Source: global traffic	TCP traffic: 192.168.2.7:49768 -> 199.187.210.54:4145
Source: global traffic	TCP traffic: 192.168.2.7:49769 -> 47.104.27.165:3128
Source: global traffic	TCP traffic: 192.168.2.7:49770 -> 78.133.163.190:4145
Source: global traffic	TCP traffic: 192.168.2.7:49771 -> 162.55.87.48:5566
Source: global traffic	TCP traffic: 192.168.2.7:49772 -> 47.238.128.246:9080
Source: global traffic	TCP traffic: 192.168.2.7:49773 -> 155.254.9.107:5678
Source: global traffic	TCP traffic: 192.168.2.7:49774 -> 184.181.217.206:4145
Source: global traffic	TCP traffic: 192.168.2.7:49775 -> 8.130.39.117:8888
Source: global traffic	TCP traffic: 192.168.2.7:49776 -> 8.130.54.67:8800
Source: global traffic	TCP traffic: 192.168.2.7:49777 -> 201.221.134.74:5678
Source: global traffic	TCP traffic: 192.168.2.7:49779 -> 103.174.178.147:2454
Source: global traffic	TCP traffic: 192.168.2.7:49781 -> 39.101.65.228:6000
Source: global traffic	TCP traffic: 192.168.2.7:49782 -> 107.180.88.173:61358
Source: global traffic	TCP traffic: 192.168.2.7:49783 -> 50.250.205.21:32100
Source: global traffic	TCP traffic: 192.168.2.7:49784 -> 68.1.210.163:4145
Source: global traffic	TCP traffic: 192.168.2.7:49785 -> 181.143.106.162:59391
Source: global traffic	TCP traffic: 192.168.2.7:49786 -> 102.219.33.118:1080
Source: global traffic	TCP traffic: 192.168.2.7:49787 -> 91.247.92.63:5678
Source: global traffic	TCP traffic: 192.168.2.7:49788 -> 47.122.56.158:8081
Source: global traffic	TCP traffic: 192.168.2.7:49789 -> 135.148.139.151:1080
Source: global traffic	TCP traffic: 192.168.2.7:49790 -> 184.170.249.65:4145
Source: global traffic	TCP traffic: 192.168.2.7:49791 -> 184.168.121.153:44909
Source: global traffic	TCP traffic: 192.168.2.7:49792 -> 142.166.131.50:5678
Source: global traffic	TCP traffic: 192.168.2.7:49795 -> 183.6.7.103:4145
Source: global traffic	TCP traffic: 192.168.2.7:49797 -> 196.216.13.36:5678
Source: global traffic	TCP traffic: 192.168.2.7:49798 -> 114.215.127.92:8118
Source: global traffic	TCP traffic: 192.168.2.7:49799 -> 47.251.87.74:8080
Source: global traffic	TCP traffic: 192.168.2.7:49801 -> 47.251.87.199:8081
Source: global traffic	TCP traffic: 192.168.2.7:49802 -> 137.141.148.79:8081
Source: global traffic	TCP traffic: 192.168.2.7:49803 -> 196.43.106.62:5678
Source: global traffic	TCP traffic: 192.168.2.7:49804 -> 72.210.252.137:4145
Source: global traffic	TCP traffic: 192.168.2.7:49805 -> 24.249.199.12:4145
Source: global traffic	TCP traffic: 192.168.2.7:49806 -> 166.0.235.197:12139
Source: global traffic	TCP traffic: 192.168.2.7:49807 -> 104.200.152.30:4145
Source: global traffic	TCP traffic: 192.168.2.7:49808 -> 94.131.7.1:31287
Source: global traffic	TCP traffic: 192.168.2.7:49809 -> 107.180.90.88:16002
Source: global traffic	TCP traffic: 192.168.2.7:49810 -> 181.214.152.204:1628
Source: global traffic	TCP traffic: 192.168.2.7:49811 -> 36.95.13.18:5678
Source: global traffic	TCP traffic: 192.168.2.7:49813 -> 198.8.84.3:4145
Source: global traffic	TCP traffic: 192.168.2.7:49814 -> 72.37.216.68:4145
Source: global traffic	TCP traffic: 192.168.2.7:49815 -> 203.96.177.211:57070
Source: global traffic	TCP traffic: 192.168.2.7:49816 -> 8.211.195.173:8080
Source: global traffic	TCP traffic: 192.168.2.7:49819 -> 92.205.108.94:40994
Source: global traffic	TCP traffic: 192.168.2.7:49821 -> 177.38.245.106:55713
Source: global traffic	TCP traffic: 192.168.2.7:49823 -> 177.126.86.78:4145
Source: global traffic	TCP traffic: 192.168.2.7:49824 -> 190.96.97.202:4153
Source: global traffic	TCP traffic: 192.168.2.7:49825 -> 193.143.1.201:4444
Source: global traffic	TCP traffic: 192.168.2.7:49826 -> 45.234.100.102:1080
Source: global traffic	TCP traffic: 192.168.2.7:49827 -> 70.166.167.55:57745
Source: global traffic	TCP traffic: 192.168.2.7:49828 -> 85.206.167.133:32631
Source: global traffic	TCP traffic: 192.168.2.7:49829 -> 47.116.210.163:8081
Source: global traffic	TCP traffic: 192.168.2.7:49830 -> 8.213.215.187:3128
Source: global traffic	TCP traffic: 192.168.2.7:49832 -> 213.16.81.182:35559
Source: global traffic	TCP traffic: 192.168.2.7:49833 -> 67.43.227.226:1865
Source: global traffic	TCP traffic: 192.168.2.7:49835 -> 103.253.153.242:41762
Source: global traffic	TCP traffic: 192.168.2.7:49836 -> 24.249.199.4:4145
Source: global traffic	TCP traffic: 192.168.2.7:49837 -> 77.64.42.173:8080
Source: global traffic	TCP traffic: 192.168.2.7:49838 -> 190.138.250.48:3629
Source: global traffic	TCP traffic: 192.168.2.7:49839 -> 181.212.136.34:16522
Source: global traffic	TCP traffic: 192.168.2.7:49840 -> 178.255.44.62:26530
Source: global traffic	TCP traffic: 192.168.2.7:49841 -> 162.214.121.173:61359
Source: global traffic	TCP traffic: 192.168.2.7:49843 -> 113.103.227.189:38801
Source: global traffic	TCP traffic: 192.168.2.7:49845 -> 67.43.228.253:10769
Source: global traffic	TCP traffic: 192.168.2.7:49846 -> 162.214.227.68:51069
Source: global traffic	TCP traffic: 192.168.2.7:49848 -> 182.253.146.155:4153
Source: global traffic	TCP traffic: 192.168.2.7:49849 -> 72.10.164.178:26425
Source: global traffic	TCP traffic: 192.168.2.7:49850 -> 47.90.149.238:3128
Source: global traffic	TCP traffic: 192.168.2.7:49851 -> 186.219.96.47:49923
Source: global traffic	TCP traffic: 192.168.2.7:49852 -> 43.153.99.33:1080
Source: global traffic	TCP traffic: 192.168.2.7:49853 -> 159.65.188.178:53257
Source: global traffic	TCP traffic: 192.168.2.7:49854 -> 86.138.234.109:31001
Source: global traffic	TCP traffic: 192.168.2.7:49855 -> 198.23.143.4:1081
Source: global traffic	TCP traffic: 192.168.2.7:49856 -> 200.43.231.8:4153
Source: global traffic	TCP traffic: 192.168.2.7:49857 -> 81.16.1.71:5678
Source: global traffic	TCP traffic: 192.168.2.7:49858 -> 207.244.229.34:59076
Source: global traffic	TCP traffic: 192.168.2.7:49859 -> 68.71.254.6:4145
Source: global traffic	TCP traffic: 192.168.2.7:49860 -> 162.214.103.84:49497
Source: global traffic	TCP traffic: 192.168.2.7:49861 -> 67.43.236.20:7403
Source: global traffic	TCP traffic: 192.168.2.7:49862 -> 202.179.184.34:5430
Source: global traffic	TCP traffic: 192.168.2.7:49863 -> 190.144.224.182:44550
Source: global traffic	TCP traffic: 192.168.2.7:49864 -> 181.225.78.66:4153
Source: global traffic	TCP traffic: 192.168.2.7:49865 -> 91.150.77.57:56921
Source: global traffic	TCP traffic: 192.168.2.7:49866 -> 51.159.152.12:10709
Source: global traffic	TCP traffic: 192.168.2.7:49867 -> 213.16.81.147:5678
Source: global traffic	TCP traffic: 192.168.2.7:49868 -> 67.43.227.227:1661
Source: global traffic	TCP traffic: 192.168.2.7:49869 -> 132.148.166.93:22179
Source: global traffic	TCP traffic: 192.168.2.7:49870 -> 198.98.59.190:30720
Source: global traffic	TCP traffic: 192.168.2.7:49871 -> 207.244.255.174:14289
Source: global traffic	TCP traffic: 192.168.2.7:49873 -> 154.68.43.182:32755
Source: global traffic	TCP traffic: 192.168.2.7:49874 -> 200.214.154.135:4145
Source: global traffic	TCP traffic: 192.168.2.7:49875 -> 95.216.194.176:8080
Source: global traffic	TCP traffic: 192.168.2.7:49876 -> 72.195.34.42:4145
Source: global traffic	TCP traffic: 192.168.2.7:49877 -> 162.214.154.141:43581
Source: global traffic	TCP traffic: 192.168.2.7:49878 -> 103.10.99.110:5678
Source: global traffic	TCP traffic: 192.168.2.7:49879 -> 154.79.250.48:5678
Source: global traffic	TCP traffic: 192.168.2.7:49881 -> 1.9.27.219:4153
Source: global traffic	TCP traffic: 192.168.2.7:49882 -> 170.106.76.24:23988
Source: global traffic	TCP traffic: 192.168.2.7:49884 -> 170.244.64.12:31476
Source: global traffic	TCP traffic: 192.168.2.7:49885 -> 162.214.162.156:45764
Source: global traffic	TCP traffic: 192.168.2.7:49886 -> 138.255.240.66:40736
Source: global traffic	TCP traffic: 192.168.2.7:49887 -> 104.37.135.145:4145
Source: global traffic	TCP traffic: 192.168.2.7:49889 -> 46.219.1.5:5678
Source: global traffic	TCP traffic: 192.168.2.7:49891 -> 1.179.151.165:31948
Source: global traffic	TCP traffic: 192.168.2.7:49892 -> 77.65.50.118:34159
Source: global traffic	TCP traffic: 192.168.2.7:49894 -> 115.85.86.114:5678
Source: global traffic	TCP traffic: 192.168.2.7:49895 -> 50.63.13.3:4153
Source: global traffic	TCP traffic: 192.168.2.7:49896 -> 103.79.152.204:5678
Source: global traffic	TCP traffic: 192.168.2.7:49898 -> 103.182.52.159:5678
Source: global traffic	TCP traffic: 192.168.2.7:49899 -> 103.111.22.65:58563
Source: global traffic	TCP traffic: 192.168.2.7:49900 -> 92.241.66.138:4145
Source: global traffic	TCP traffic: 192.168.2.7:49902 -> 184.178.172.5:15303
Source: global traffic	TCP traffic: 192.168.2.7:49903 -> 109.238.12.156:50539
Source: global traffic	TCP traffic: 192.168.2.7:49904 -> 173.212.237.43:9170
Source: global traffic	TCP traffic: 192.168.2.7:49905 -> 178.62.7.98:33475
Source: global traffic	TCP traffic: 192.168.2.7:49906 -> 182.253.246.213:4153
Source: global traffic	TCP traffic: 192.168.2.7:49907 -> 103.135.7.2:63123
Source: global traffic	TCP traffic: 192.168.2.7:49908 -> 162.241.45.22:42021
Source: global traffic	TCP traffic: 192.168.2.7:49909 -> 110.139.128.232:4145
Source: global traffic	TCP traffic: 192.168.2.7:49911 -> 185.18.198.163:38188
Source: global traffic	TCP traffic: 192.168.2.7:49912 -> 185.78.16.76:5678
Source: global traffic	TCP traffic: 192.168.2.7:49913 -> 199.102.104.70:4145
Source: global traffic	TCP traffic: 192.168.2.7:49914 -> 184.178.172.11:4145
Source: global traffic	TCP traffic: 192.168.2.7:49915 -> 200.85.169.221:1080
Source: global traffic	TCP traffic: 192.168.2.7:49916 -> 97.74.229.3:45644
Source: global traffic	TCP traffic: 192.168.2.7:49917 -> 103.47.93.236:1080
Source: global traffic	TCP traffic: 192.168.2.7:49918 -> 8.213.156.191:9080
Source: global traffic	TCP traffic: 192.168.2.7:49919 -> 103.141.189.62:5678
Source: global traffic	TCP traffic: 192.168.2.7:49920 -> 45.251.57.49:4153
Source: global traffic	TCP traffic: 192.168.2.7:49921 -> 81.12.169.254:4153
Source: global traffic	TCP traffic: 192.168.2.7:49922 -> 195.2.76.207:11531
Source: global traffic	TCP traffic: 192.168.2.7:49923 -> 185.32.47.105:4153
Source: global traffic	TCP traffic: 192.168.2.7:49925 -> 166.62.88.163:14827
Source: global traffic	TCP traffic: 192.168.2.7:49924 -> 141.105.107.152:5678
Source: global traffic	TCP traffic: 192.168.2.7:49926 -> 103.121.214.50:4145
Source: global traffic	TCP traffic: 192.168.2.7:49927 -> 148.72.210.123:7749
Source: global traffic	TCP traffic: 192.168.2.7:49928 -> 198.12.253.239:39820
Source: global traffic	TCP traffic: 192.168.2.7:49929 -> 135.148.10.161:19212
Source: global traffic	TCP traffic: 192.168.2.7:49930 -> 162.214.75.237:24949
Source: global traffic	TCP traffic: 192.168.2.7:49931 -> 45.124.84.110:15473
Source: global traffic	TCP traffic: 192.168.2.7:49935 -> 92.205.110.118:46394
Source: global traffic	TCP traffic: 192.168.2.7:49936 -> 45.89.19.85:15397
Source: global traffic	TCP traffic: 192.168.2.7:49937 -> 181.28.137.18:5678
Source: global traffic	TCP traffic: 192.168.2.7:49938 -> 5.188.66.181:8088
Source: global traffic	TCP traffic: 192.168.2.7:49941 -> 1.179.148.9:36476
Source: global traffic	TCP traffic: 192.168.2.7:49942 -> 103.36.35.251:5678

Source: global traffic

HTTP traffic detected: GET /v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all HTTP/1.1Host: api.proxyscrape.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 193.143.1.201 193.143.1.201
Source: Joe Sandbox View	IP Address: 193.143.1.201 193.143.1.201
Source: Joe Sandbox View	IP Address: 184.178.172.3 184.178.172.3

Source: Joe Sandbox View	ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC
Source: Joe Sandbox View	ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: tools.keycdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.170.33
Source: unknown	TCP traffic detected without corresponding DNS query: 190.12.95.170
Source: unknown	TCP traffic detected without corresponding DNS query: 132.148.167.243
Source: unknown	TCP traffic detected without corresponding DNS query: 198.8.94.174
Source: unknown	TCP traffic detected without corresponding DNS query: 199.116.114.11
Source: unknown	TCP traffic detected without corresponding DNS query: 184.181.217.213
Source: unknown	TCP traffic detected without corresponding DNS query: 51.81.31.64
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.222.90
Source: unknown	TCP traffic detected without corresponding DNS query: 177.104.87.23
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.43.198
Source: unknown	TCP traffic detected without corresponding DNS query: 98.103.88.158
Source: unknown	TCP traffic detected without corresponding DNS query: 115.73.130.122
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.205.144
Source: unknown	TCP traffic detected without corresponding DNS query: 177.85.157.25
Source: unknown	TCP traffic detected without corresponding DNS query: 85.89.184.87
Source: unknown	TCP traffic detected without corresponding DNS query: 1.179.148.33
Source: unknown	TCP traffic detected without corresponding DNS query: 46.231.72.35
Source: unknown	TCP traffic detected without corresponding DNS query: 199.233.238.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.170.33
Source: unknown	TCP traffic detected without corresponding DNS query: 190.12.95.170
Source: unknown	TCP traffic detected without corresponding DNS query: 132.148.167.243
Source: unknown	TCP traffic detected without corresponding DNS query: 198.8.94.174
Source: unknown	TCP traffic detected without corresponding DNS query: 199.116.114.11
Source: unknown	TCP traffic detected without corresponding DNS query: 184.181.217.213
Source: unknown	TCP traffic detected without corresponding DNS query: 51.81.31.64
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.222.90
Source: unknown	TCP traffic detected without corresponding DNS query: 177.104.87.23
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.43.198
Source: unknown	TCP traffic detected without corresponding DNS query: 98.103.88.158
Source: unknown	TCP traffic detected without corresponding DNS query: 177.85.157.25
Source: unknown	TCP traffic detected without corresponding DNS query: 115.73.130.122
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.205.144
Source: unknown	TCP traffic detected without corresponding DNS query: 85.89.184.87
Source: unknown	TCP traffic detected without corresponding DNS query: 1.179.148.33
Source: unknown	TCP traffic detected without corresponding DNS query: 46.231.72.35
Source: unknown	TCP traffic detected without corresponding DNS query: 95.111.227.164
Source: unknown	TCP traffic detected without corresponding DNS query: 199.233.238.6
Source: unknown	TCP traffic detected without corresponding DNS query: 188.173.14.99
Source: unknown	TCP traffic detected without corresponding DNS query: 95.111.227.164
Source: unknown	TCP traffic detected without corresponding DNS query: 188.173.14.99
Source: unknown	TCP traffic detected without corresponding DNS query: 98.103.88.158
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.205.144
Source: unknown	TCP traffic detected without corresponding DNS query: 177.85.157.25
Source: unknown	TCP traffic detected without corresponding DNS query: 115.73.130.122
Source: unknown	TCP traffic detected without corresponding DNS query: 85.89.184.87
Source: unknown	TCP traffic detected without corresponding DNS query: 177.104.87.23
Source: unknown	TCP traffic detected without corresponding DNS query: 184.181.217.213
Source: unknown	TCP traffic detected without corresponding DNS query: 132.148.167.243
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.43.198
Source: unknown	TCP traffic detected without corresponding DNS query: 109.120.222.90

Source: global traffic	HTTP traffic detected: GET /v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all HTTP/1.1Host: api.proxyscrape.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: tools.keycdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.proxyscrape.com
Source: global traffic	DNS traffic detected: DNS query: tools.keycdn.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 20 Jul 2024 00:24:20 GMTContent-Type: application/jsonContent-Length: 119Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8Proxy-Authenticate: Basic realm=""errorMsg: Unsupported protocoData Raw: Data Ascii:

Source: svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: svchost.exe, 00000006.00000002.3718514450.00000000228D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: svchost.exe, 00000006.00000002.3702274640.00000000012BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3715047702.000000001BC13000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000006.00000002.3715047702.000000001BC13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a9d03c928ddde
Source: kz7iLmqRuq.exe, 00000000.00000002.1260097588.0000000003471000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 00000006.00000002.3703686375.000000000375A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tools.keycdn.com
Source: svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipH
Source: svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.0000000003316000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: kz7iLmqRuq.exe, svchost.exe.0.dr	String found in binary or memory: https://api.ipify.org/
Source: svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.p:P
Source: svchost.exe, 00000006.00000002.3703686375.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.proxyscrape.com
Source: kz7iLmqRuq.exe, svchost.exe.0.dr	String found in binary or memory: https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl
Source: kz7iLmqRuq.exe, svchost.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: kz7iLmqRuq.exe, svchost.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: kz7iLmqRuq.exe, svchost.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: svchost.exe, 00000006.00000002.3703686375.000000000375A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.keycP
Source: svchost.exe, 00000006.00000002.3703686375.000000000375A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.keycdn.com
Source: svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.0000000003316000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.keycdn.com/geo
Source: kz7iLmqRuq.exe, svchost.exe.0.dr	String found in binary or memory: https://tools.keycdn.com/geo.json

Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947

Source: unknown	HTTPS traffic detected: 104.18.11.5:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.172.148.96:443 -> 192.168.2.7:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49948 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: kz7iLmqRuq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1234830899.0000000000FA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1262889498.000000001BFE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kz7iLmqRuq.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: kz7iLmqRuq.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: kz7iLmqRuq.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: kz7iLmqRuq.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACCD93E8	6_2_00007FFAACCD93E8
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACCD9408	6_2_00007FFAACCD9408
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF91DDD	6_2_00007FFAACF91DDD
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACFA1CBA	6_2_00007FFAACFA1CBA
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF9000A	6_2_00007FFAACF9000A
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACFA2F25	6_2_00007FFAACFA2F25
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF909D1	6_2_00007FFAACF909D1
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF9EA42	6_2_00007FFAACF9EA42
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACFAF273	6_2_00007FFAACFAF273
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACFB4935	6_2_00007FFAACFB4935
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF9DC96	6_2_00007FFAACF9DC96
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACFB15C5	6_2_00007FFAACFB15C5
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF91F0B	6_2_00007FFAACF91F0B
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACFB0A61	6_2_00007FFAACFB0A61
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAAD041501	6_2_00007FFAAD041501

Source: kz7iLmqRuq.exe, 00000000.00000000.1234830899.0000000000FA2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs kz7iLmqRuq.exe
Source: kz7iLmqRuq.exe, 00000000.00000002.1262889498.000000001BFE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs kz7iLmqRuq.exe
Source: kz7iLmqRuq.exe	Binary or memory string: OriginalFilenameClient.exe. vs kz7iLmqRuq.exe

Source: kz7iLmqRuq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kz7iLmqRuq.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: kz7iLmqRuq.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: kz7iLmqRuq.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/4@3/100

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

File created: C:\Users\user\AppData\Roaming\Microsoft Windows

Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\80038a66-0dbb-4135-8eb1-4ce5a34ce41b
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5380:120:WilError_03

Source: kz7iLmqRuq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kz7iLmqRuq.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kz7iLmqRuq.exe	ReversingLabs: Detection: 78%
Source: kz7iLmqRuq.exe	Virustotal: Detection: 75%

Source: kz7iLmqRuq.exe	String found in binary or memory: (Failed to get the host IP-address '{0}'.
Source: kz7iLmqRuq.exe	String found in binary or memory: HasSubValue3Conflicting item/add type

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

File read: C:\Users\user\Desktop\kz7iLmqRuq.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\kz7iLmqRuq.exe "C:\Users\user\Desktop\kz7iLmqRuq.exe"
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"
Source: unknown	Process created: C:\Users\user\Desktop\kz7iLmqRuq.exe C:\Users\user\Desktop\kz7iLmqRuq.exe
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: kz7iLmqRuq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kz7iLmqRuq.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: kz7iLmqRuq.exe

Static file information: File size 3033088 > 1048576

Source: kz7iLmqRuq.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2e3800

Source: kz7iLmqRuq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACBBD2A5 pushad ; iretd	6_2_00007FFAACBBD2A6
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACCDD3D0 push eax; iretd	6_2_00007FFAACCDD3D9
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACFB5AB6 push ebp; retf 5F1Eh	6_2_00007FFAACFB5AD8
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF95958 push esi; retf	6_2_00007FFAACF959D7
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF97C99 push ds; retn 5F20h	6_2_00007FFAACF97D0F
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Code function: 6_2_00007FFAACF9516D push ebx; retn 0007h	6_2_00007FFAACF951BA

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

File created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

File created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	File opened: C:\Users\user\Desktop\kz7iLmqRuq.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 10709 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 23988 -> 49882

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Memory allocated: 3370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Memory allocated: 1B470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Memory allocated: 30E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Memory allocated: 1B0E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Memory allocated: EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Memory allocated: 1A9C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window / User API: threadDelayed 6357			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window / User API: threadDelayed 3187			Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe TID: 6660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 6944	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 6944	Thread sleep time: -58107243832185051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 2356	Thread sleep count: 6357 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 2356	Thread sleep count: 3187 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 3540	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe TID: 6692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000006.00000002.3719396542.0000000024A0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000006.00000002.3719314346.00000000229EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWMSAFD Tcpip [UDP/IPv6]
Source: svchost.exe, 00000006.00000002.3714957523.000000001BC03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@H

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.220.141.8 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 34.124.190.108 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.251.87.199 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 193.143.1.201 4444	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 196.43.106.62 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.178.172.3 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.81.117.225 4153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 39.101.65.228 6000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.170 24447	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.210 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.43.227.226 1865	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.172 20679	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.102.106.94 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 155.254.9.107 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 183.6.7.103 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 201.221.134.74 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.213 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.126.86.78 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.129.145 16894	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 1.179.148.33 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 36.95.13.18 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.252.208.70 14282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.104.87.23 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.87.81.86 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.8.94.174 39078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 154.12.253.232 41739	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 14.225.62.76 6666	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.172.148.96 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 197.234.58.102 32767	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 83.235.22.245 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.37.216.68 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.206 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.0.235.197 12139	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 51.81.31.64 15062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 92.205.108.94 40994	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.253.153.242 41762	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.54.67 8800	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 189.175.197.223 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 39.100.88.89 3128	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 78.133.163.190 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.8.84.3 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 135.148.139.151 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.122.56.158 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 5.22.154.50 60606	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.238.128.246 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.104.28.135 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 102.219.33.118 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 85.206.167.133 32631	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.96.97.202 4153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 64.124.191.98 32688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 77.64.42.173 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.141.233.168 1287	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 188.173.14.99 36835	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 139.180.169.114 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 137.141.148.79 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.116.210.163 8081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 23.105.170.33 38930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 168.227.158.65 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 213.16.81.182 35559	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 24.249.199.4 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 74.119.147.209 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 50.250.205.21 32100	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 189.201.191.18 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.18.11.5 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 109.120.222.90 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 24.249.199.12 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.122.60.157 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.200.152.30 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.233.238.6 3373	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.180.90.88 16002	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 98.170.57.231 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.12.95.170 37209	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 94.23.220.136 59415	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 76.26.105.162 8833	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.252.20.42 10243	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.85.157.25 4153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 114.215.127.92 8118	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.239.80.124 570	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 196.216.13.36 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 203.96.177.211 57070	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.104.27.165 3128	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.174.178.147 2454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.180.88.173 6453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 70.166.167.38 57728	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.211.195.173 8080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.187.210.54 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 95.111.227.164 45028	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 66.23.233.210 62979	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 93.158.155.18 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 91.247.92.63 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 195.154.43.198 15722	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 68.1.210.163 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 98.170.57.249 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.116.114.11 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.213.212.129 58535	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 161.97.163.52 61912	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.238.100.115 45314	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.251.87.74 9080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.254.36.213 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.252.220.92 17328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 181.214.152.204 1628	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 35.185.195.201 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 85.89.184.87 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.38.245.106 55713	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 202.69.38.42 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.234.100.102 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 147.124.212.31 8259	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.39.117 9090	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.26.13.205 443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.216.204.146 1080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 94.131.7.1 31287	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 115.73.130.122 24093	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 181.143.106.162 59391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 46.231.72.35 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 173.212.205.144 62909	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.210.252.137 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.137.34 18765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 142.166.131.50 5678	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.137.35 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.195.114.169 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.108.84.168 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.90 20347	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.213.215.187 3128	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 189.226.237.127 80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.170.249.65 4145	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 98.103.88.158 46104	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 70.166.167.55 57745	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 132.148.167.243 53197	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.55.87.48 5566	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.168.121.153 44909	Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Queries volume information: C:\Users\user\Desktop\kz7iLmqRuq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kz7iLmqRuq.exe	Queries volume information: C:\Users\user\Desktop\kz7iLmqRuq.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\kz7iLmqRuq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: kz7iLmqRuq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1234830899.0000000000FA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1262889498.000000001BFE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kz7iLmqRuq.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: kz7iLmqRuq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kz7iLmqRuq.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1234830899.0000000000FA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1262889498.000000001BFE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kz7iLmqRuq.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	11 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kz7iLmqRuq.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
kz7iLmqRuq.exe	76%	Virustotal		Browse
kz7iLmqRuq.exe	100%	Avira	HEUR/AGEN.1307418
kz7iLmqRuq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	100%	Avira	HEUR/AGEN.1307418
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	76%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
tools.keycdn.com	0%	Virustotal	Browse
api.ipify.org	0%	Virustotal	Browse
api.proxyscrape.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl	0%	Avira URL Cloud	safe
https://api.ipH	0%	Avira URL Cloud	safe
https://tools.keycdn.com/geo.json	0%	Virustotal		Browse
https://tools.keycdn.com	0%	Virustotal		Browse
https://tools.keycdn.com/geo	0%	Virustotal		Browse
https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl	1%	Virustotal		Browse
https://tools.keycdn.com/geo.json	0%	Avira URL Cloud	safe
https://tools.keycdn.com/geo	0%	Avira URL Cloud	safe
https://tools.keycdn.com	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/2152978/23354sCannot	0%	Avira URL Cloud	safe
https://tools.keycP	0%	Avira URL Cloud	safe
https://api.p:P	0%	Avira URL Cloud	safe
45.66.231.154	0%	Avira URL Cloud	safe
http://tools.keycdn.com	0%	Avira URL Cloud	safe
https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all	0%	Avira URL Cloud	safe
https://api.proxyscrape.com	0%	Avira URL Cloud	safe
http://api.ipify.org	0%	Avira URL Cloud	safe
http://tools.keycdn.com	0%	Virustotal		Browse
45.66.231.154	2%	Virustotal		Browse
https://api.proxyscrape.com	2%	Virustotal		Browse
https://stackoverflow.com/q/2152978/23354sCannot	0%	Virustotal		Browse
https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all	4%	Virustotal		Browse
http://api.ipify.org	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tools.keycdn.com	185.172.148.96	true	true	0%, Virustotal, Browse	unknown
api.ipify.org	104.26.13.205	true	true	0%, Virustotal, Browse	unknown
api.proxyscrape.com	104.18.11.5	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	true	URL Reputation: safe URL Reputation: safe	unknown
https://tools.keycdn.com/geo.json	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
45.66.231.154	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.0000000003316000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipH	svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	kz7iLmqRuq.exe, svchost.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl	kz7iLmqRuq.exe, svchost.exe.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tools.keycdn.com/geo	svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.0000000003316000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.0000000003756000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	kz7iLmqRuq.exe, svchost.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://tools.keycdn.com	svchost.exe, 00000006.00000002.3703686375.000000000375A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tools.keycP	svchost.exe, 00000006.00000002.3703686375.000000000375A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tools.keycdn.com	svchost.exe, 00000006.00000002.3703686375.000000000375A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/2152978/23354sCannot	kz7iLmqRuq.exe, svchost.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kz7iLmqRuq.exe, 00000000.00000002.1260097588.0000000003471000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3703686375.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.p:P	svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.proxyscrape.com	svchost.exe, 00000006.00000002.3703686375.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://api.ipify.org	svchost.exe, 00000006.00000002.3703686375.0000000003778000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.220.141.8	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
43.153.99.33	unknown	Japan	4249	LILLY-ASUS	false
5.188.66.181	unknown	Kazakhstan	200590	ASNLSKZ	false
47.251.87.199	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
193.143.1.201	unknown	unknown	57271	BITWEB-ASRU	true
198.23.143.4	unknown	United States	36352	AS-COLOCROSSINGUS	false
184.178.172.3	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
103.81.117.225	unknown	India	135851	PARTHIV-ASExcogitateTechnologiesPvtLtdIN	true
184.178.172.5	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
67.43.227.227	unknown	Canada	36666	GTCOMMCA	false
67.43.227.226	unknown	Canada	36666	GTCOMMCA	true
68.71.254.6	unknown	United States	20093	ZEROLAGUS	false
199.102.104.70	unknown	United States	20093	ZEROLAGUS	false
119.59.101.111	unknown	Thailand	56067	METRABYTE-TH453LadplacoutJorakhaebuaTH	false
201.221.134.74	unknown	Colombia	22368	TELEBUCARAMANGASAESPCO	true
177.126.86.78	unknown	Brazil	262352	NOVATELECOMLTDABR	true
207.244.255.174	unknown	United States	40021	CONTABOUS	true
1.179.148.33	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
36.95.13.18	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	true
8.213.156.191	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
103.87.81.86	unknown	Indonesia	4787	ASN-CBNPTCyberindoAditamaID	true
198.8.94.174	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	true
91.150.77.57	unknown	Serbia	8400	TELEKOM-ASRS	true
103.152.112.234	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
185.172.148.96	tools.keycdn.com	Germany	44239	PROINITYPROINITYDE	true
185.32.47.105	unknown	Azerbaijan	200154	IZONE-ASAZ	false
83.235.22.245	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	true
72.37.216.68	unknown	United States	20093	ZEROLAGUS	true
159.65.188.178	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
181.225.78.66	unknown	Colombia	27951	MediaCommercePartnersSACO	false
51.81.31.64	unknown	United States	16276	OVHFR	true
92.205.108.94	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
103.253.153.242	unknown	India	132540	AISPL-AS-APAIRNATITSOLUTIONSPVTLTDIN	true
8.130.54.67	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
189.175.197.223	unknown	Mexico	8151	UninetSAdeCVMX	true
39.100.88.89	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
198.8.84.3	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	true
5.22.154.50	unknown	Czech Republic	60829	ASNEVERNETSK	true
47.238.128.246	unknown	United States	20115	CHARTER-20115US	true
47.104.28.135	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
103.111.22.65	unknown	India	133673	KWIKZO-ASKWIKZOComTechnologyPrivateLimitedIN	false
103.47.93.236	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	false
77.64.42.173	unknown	Saudi Arabia	25233	AWALNET-ASNSA	true
67.43.228.253	unknown	Canada	36666	GTCOMMCA	true
137.141.148.79	unknown	United States	13536	TVC-AS1US	true
1.9.27.219	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
181.28.137.18	unknown	Argentina	10318	TelecomArgentinaSAAR	false
168.227.158.65	unknown	Brazil	52898	MultiplaServicosInteligentesBR	true
141.105.107.152	unknown	Spain	200064	IB-REDASES	false
186.219.96.47	unknown	Brazil	262420	GIGATVLTDA-EPPBR	false
154.79.250.48	unknown	Kenya	36926	CKL1-ASNKE	false
74.119.147.209	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	true
50.250.205.21	unknown	United States	7922	COMCAST-7922US	true
104.18.11.5	api.proxyscrape.com	United States	13335	CLOUDFLARENETUS	true
24.249.199.12	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
47.122.60.157	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
195.2.76.207	unknown	Russian Federation	48282	VDSINA-ASRU	false
198.12.253.239	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
199.233.238.6	unknown	United States	46261	QUICKPACKETUS	true
107.180.90.88	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
178.62.7.98	unknown	European Union	14061	DIGITALOCEAN-ASNUS	false
94.23.220.136	unknown	France	16276	OVHFR	true
162.214.103.84	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
203.96.177.211	unknown	Bangladesh	56030	VOYAGERNET-AS-APVoyagerInternetLtdNZ	true
103.36.35.251	unknown	Indonesia	131111	CEPATNET-AS-IDPTMoraTelematikaIndonesiaID	false
47.104.27.165	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
103.174.178.147	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true
107.180.88.173	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
113.103.227.189	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
78.146.180.112	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
207.244.229.34	unknown	United States	40021	CONTABOUS	true
182.253.146.155	unknown	Indonesia	17451	BIZNET-AS-APBIZNETNETWORKSID	false
8.211.195.173	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
190.138.250.48	unknown	Argentina	7303	TelecomArgentinaSAAR	false
66.23.233.210	unknown	United States	19318	IS-AS-1US	true
93.158.155.18	unknown	Russian Federation	13238	YANDEXRU	true
91.247.92.63	unknown	Ukraine	49389	STEALTH-ASUA	true
199.116.114.11	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	true
67.213.212.129	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
142.138.80.36	unknown	Canada	3456	TWC-3456-ITUS	false
47.254.36.213	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
181.214.152.204	unknown	Chile	61317	ASDETUKhttpwwwheficedcomGB	true
85.89.184.87	unknown	Poland	16342	TOYATOYASpzooPL	true
177.38.245.106	unknown	Brazil	52974	HenetTelecomunicacoesLtdaBR	true
77.65.50.118	unknown	Poland	13110	INEA-ASPL	true
202.69.38.42	unknown	Pakistan	23750	GERRYS-AS-APGERRYSINFORMATIONTECHNOLOGYPVTLTDPK	true
147.124.212.31	unknown	United States	1432	AC-AS-1US	true
8.130.39.117	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	true
94.131.7.1	unknown	Ukraine	29632	NASSIST-ASGI	true
162.214.154.141	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
46.231.72.35	unknown	Czech Republic	34093	PLUSLINE-ASCZ	true
173.212.205.144	unknown	Germany	51167	CONTABODE	true
72.210.252.137	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
142.166.131.50	unknown	Canada	855	CANET-ASN-4CA	true
72.195.114.169	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
200.43.231.8	unknown	Argentina	7303	TelecomArgentinaSAAR	false
72.10.160.90	unknown	Canada	36666	GTCOMMCA	true
8.213.215.187	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
189.226.237.127	unknown	Mexico	8151	UninetSAdeCVMX	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1477111
Start date and time:	2024-07-20 02:23:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kz7iLmqRuq.exe renamed because original name is a hash value
Original Sample Name:	4ebd63449193b8fdbd0c0315f8e33e10.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@16/4@3/100
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 54 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, time.windows.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target kz7iLmqRuq.exe, PID 4220 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:24:01	Task Scheduler	Run new task: svchost path: C:\Users\user\Desktop\kz7iLmqRuq.exe
20:24:03	API Interceptor	16193973x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.188.66.181	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse
193.143.1.201	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	TrkLU8M8Ai.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	HtfOQz42tN.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	3011574829.exe	Get hash	malicious	Unknown	Browse	artemis-rat.comartemis-rat.com:443
	reimainternatio.exe	Get hash	malicious	FormBook	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	75C8OqdJUQ.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	75C8OqdJUQ.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	Reiven RFQ-04032024.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	Quotation.pdf.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
184.178.172.3	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tools.keycdn.com	e03WpAyb8R.exe	Get hash	malicious	Quasar	Browse	185.172.148.96
	37FA30C9DCF255BDA62C0A6B7F88A48263A3DA18D18D8.exe	Get hash	malicious	Quasar	Browse	185.172.148.96
	u0C4BiWpdl.exe	Get hash	malicious	Unknown	Browse	185.172.148.96
	Helpertask.exe	Get hash	malicious	Quasar	Browse	185.172.148.96
	4C600D6CFD08ECC5AFEF504A07B8DCFFD042D613A7FE6.exe	Get hash	malicious	Quasar	Browse	185.172.148.96
	FB0D11B408EC7A227F03AFD2B28D9759D4FB2BED11273.exe	Get hash	malicious	Quasar	Browse	185.172.148.96
	r2wd0vCZr1.exe	Get hash	malicious	Quasar, XWorm	Browse	185.172.148.96
	yVBcRJPDU6.exe	Get hash	malicious	Blank Grabber, Quasar	Browse	185.172.148.96
	65hqt7PfEA.exe	Get hash	malicious	Quasar	Browse	185.172.148.96
	eF9txe6Mht.exe	Get hash	malicious	Quasar, Xmrig	Browse	185.172.148.96
api.ipify.org	http://pub-6d4ffd18b60b47739e1d6be3b9e5e9d4.r2.dev/auth_response.html?folder=anzlbqtvi6&module=	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://982higruaha39f.vercel.app/	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://www.canva.com/design/DAGLaedvVgo/Jbg8hLNrfFSAKWzllyUcYA/edit?utm_content=DAGLaedvVgo&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse	104.26.13.205
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse	104.26.12.205
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Solicitud de precio Img_Quotation PO 202400931.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Revised PI_2024.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	payment_application.xls	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	8hOkq9mMQu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
api.proxyscrape.com	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	104.18.11.5
	UrQrIdRfCg.exe	Get hash	malicious	Unknown	Browse	104.18.11.5
	UrQrIdRfCg.exe	Get hash	malicious	Unknown	Browse	104.18.10.5
	UrQrIdRfCg.exe	Get hash	malicious	Unknown	Browse	104.18.10.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	http://web-whatsapp-kf.co/	Get hash	malicious	Unknown	Browse	8.217.64.234
	http://web-whatsapp-kf.work/	Get hash	malicious	Unknown	Browse	8.218.243.5
	jonathan.cody e-Doc File_014216.docx	Get hash	malicious	HTMLPhisher	Browse	47.246.131.135
	TWzzHuqCOF.elf	Get hash	malicious	Mirai	Browse	47.241.69.57
	lookworldafs1244.msi	Get hash	malicious	Unknown	Browse	8.213.195.255
	Magmutual-Contractual-Agreement-usqe-276342429-.docx	Get hash	malicious	HTMLPhisher	Browse	47.246.131.28
	Scanner_SKME092878673568739809289728639802765768729809208.pdf	Get hash	malicious	Unknown	Browse	47.246.136.160
	Setup_Mop.166_1.exe	Get hash	malicious	Unknown	Browse	8.218.245.166
	https://1drv.ms/o/s!AhamKbFAgjbffS1Sylq61px7DxI?e=AvRhOV	Get hash	malicious	SharepointPhisher	Browse	47.246.131.60
	PO-2024151-pdf.gz.exe	Get hash	malicious	FormBook	Browse	47.251.26.138
LILLY-ASUS	http://icioud-ios.com/	Get hash	malicious	Unknown	Browse	43.134.58.153
	TWzzHuqCOF.elf	Get hash	malicious	Mirai	Browse	42.130.115.82
	LRMAuF4TbF.elf	Get hash	malicious	Mirai	Browse	43.118.46.88
	8tGqHMzByM.elf	Get hash	malicious	Mirai	Browse	43.32.221.135
	l5EsscvvPL.elf	Get hash	malicious	Mirai	Browse	43.85.16.33
	MCiOZ89mRZ.elf	Get hash	malicious	Mirai	Browse	40.253.158.24
	http://www.fotoschuppen.net/	Get hash	malicious	Unknown	Browse	43.175.135.229
	ToDeskApp_HYI.x64.msi	Get hash	malicious	Unknown	Browse	43.152.26.142
	ToDeskApp_HYI.x64.msi	Get hash	malicious	Unknown	Browse	43.132.66.196
	winInst.exe	Get hash	malicious	GhostRat	Browse	43.132.105.108
ASNLSKZ	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	5.188.66.181
	Contract 2024-2.pdf	Get hash	malicious	HTMLPhisher	Browse	185.97.113.74
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	5.188.64.229
	phish_alert_sp2_2.0.0.0 (14).eml	Get hash	malicious	HTMLPhisher	Browse	185.97.113.74
	https://tanauto.kz/?url=//Rgfstaffing%25E3%2580%2582energycomercio%25E3%2580%2582com%25E3%2580%2582br%2Fomluabie%2Fomowunmis%2FRgfstaffing4i4h7siub%2Fcm9iLnphbmRiZXJnZW5Acmdmc3RhZmZpbmcuY29t	Get hash	malicious	Unknown	Browse	185.97.113.74
	most-x86_64.elf	Get hash	malicious	Mirai	Browse	79.143.20.108
	h3fEC40gwe.elf	Get hash	malicious	Unknown	Browse	87.255.198.179
	https://tanauto.kz/?url=https://woolyx.com/wp-content/auth/milestoneaviation.com/rfarnese@milestoneaviation.com	Get hash	malicious	HTMLPhisher	Browse	185.97.113.74
	BKrGUEtpSQ.elf	Get hash	malicious	Mirai	Browse	93.190.241.121
	qvV34ruRr1.exe	Get hash	malicious	Wannacry	Browse	93.190.241.254
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	http://web-whatsapp-kf.co/	Get hash	malicious	Unknown	Browse	8.217.64.234
	http://web-whatsapp-kf.work/	Get hash	malicious	Unknown	Browse	8.218.243.5
	jonathan.cody e-Doc File_014216.docx	Get hash	malicious	HTMLPhisher	Browse	47.246.131.135
	TWzzHuqCOF.elf	Get hash	malicious	Mirai	Browse	47.241.69.57
	lookworldafs1244.msi	Get hash	malicious	Unknown	Browse	8.213.195.255
	Magmutual-Contractual-Agreement-usqe-276342429-.docx	Get hash	malicious	HTMLPhisher	Browse	47.246.131.28
	Scanner_SKME092878673568739809289728639802765768729809208.pdf	Get hash	malicious	Unknown	Browse	47.246.136.160
	Setup_Mop.166_1.exe	Get hash	malicious	Unknown	Browse	8.218.245.166
	https://1drv.ms/o/s!AhamKbFAgjbffS1Sylq61px7DxI?e=AvRhOV	Get hash	malicious	SharepointPhisher	Browse	47.246.131.60
	PO-2024151-pdf.gz.exe	Get hash	malicious	FormBook	Browse	47.251.26.138

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://candid-dolphin-01tk1111-cd9f5b.netlify.app/form.html	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	http://mj-api.kun-ai.com/	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	http://pub-6d4ffd18b60b47739e1d6be3b9e5e9d4.r2.dev/auth_response.html?folder=anzlbqtvi6&module=	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	https://f005.backblazeb2.com/file/roboties48/index.html	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	http://krakbnlogion.gitbook.io/	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	http://web-whatsapp-kf.work/	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	http://pub-1dd7b90631c74fba943bd19e54a710f8.r2.dev/home.html	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	https://cd9688-law-library-cd9688z21.netlify.app/form.html	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	https://kp3sp.shop/	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5
	http://pub-7de030c98a6740c8991a8d1291b6513e.r2.dev/index.html	Get hash	malicious	Unknown	Browse	104.26.13.205 185.172.148.96 104.18.11.5

Process:	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1272885043655076
Encrypted:	false
SSDEEP:	6:kKcU3D9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:E8aDnLNkPlE99SNxAhUe/3
MD5:	5236A030D5ABBA30DC2D688C4BCC8D66
SHA1:	C90B026F0821649D70108029849CE6C63111D65F
SHA-256:	F67E876D05C00BD430BF67D0F8C4B51BB2A62FED274EF83811431767310AED3F
SHA-512:	B3330D5A01F26DE0BA0F3D2CF4AD5D7D7728CE9420638384CDFE4000D14DF4458819A4FE32C9974F2105AFD3154B6F9065699102CA71003D62F1F931281E100F
Malicious:	false
Reputation:	low
Preview:	p...... ..........K2=...(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\kz7iLmqRuq.exe.log

Download File

Process:	C:\Users\user\Desktop\kz7iLmqRuq.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Download File

Process:	C:\Users\user\Desktop\kz7iLmqRuq.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3033088
Entropy (8bit):	6.0872677745325126
Encrypted:	false
SSDEEP:	49152:yPXGSVuFey6JK1TGcbEtiAobDv4Rza32ehyfT:yPXdw6JkTGcbEEA
MD5:	4EBD63449193B8FDBD0C0315F8E33E10
SHA1:	31D7B7AEE638DFDBFB2E2F009D27AD30637F5953
SHA-256:	7D21BBBCB3E0F709DD351C1EDC4D52EFAE8DA0EDF341121C17A6CFB1A9ECC7B2
SHA-512:	354555AA35EBB991302E12C36D1698646D7FCBBAD8B6E77EDA7255A0C7DB4447C2D9BFB8A5669D1E93BA76F14624934646BCB2517C7A45A6CE051519371CF3E8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: ditekshen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 76%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P;.f.................8...........V... ........@.. ....................................@..................................U..O....`............................................................................... ............... ..H............text...46... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............F..............@..B.................V......H...........<i..........\|b...%........................................... .a....0..\..................}.......}.......}.....%(...+..(.......(...+...........(.....(..... ....n..o....&.0..........s..... 0...(.....(.... .'..(....~....o......}....s.....~.......+0......s......(..........%....o....o......&....X....i2..o......+Ps.........}........(....}....+..d(......{....{....~..../.........s....s....(......(....-...........o......d(.....{....~..../.~....o.....1..........F.$j..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.0872677745325126
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	kz7iLmqRuq.exe
File size:	3'033'088 bytes
MD5:	4ebd63449193b8fdbd0c0315f8e33e10
SHA1:	31d7b7aee638dfdbfb2e2f009d27ad30637f5953
SHA256:	7d21bbbcb3e0f709dd351c1edc4d52efae8da0edf341121c17a6cfb1a9ecc7b2
SHA512:	354555aa35ebb991302e12c36d1698646d7fcbbad8b6e77eda7255a0c7db4447c2d9bfb8a5669d1e93ba76f14624934646bcb2517c7a45a6ce051519371cf3e8
SSDEEP:	49152:yPXGSVuFey6JK1TGcbEtiAobDv4Rza32ehyfT:yPXdw6JkTGcbEEA
TLSH:	71E57B143BFC5E27E16E8B72A5B0401293F1F81AF3A7DB4F6191A27A1D53B40AD412B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P;.f.................8...........V... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6e562e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66903B50 [Thu Jul 11 20:06:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e55dc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e6000	0xa93	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e3634	0x2e3800	58b6b5db2af12cfb06b11f6cfc984d93	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2e6000	0xa93	0xc00	1e8890a9c95b4fde40ce5e1454704f08	False	0.3626302083333333	data	4.651504940665322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e8000	0xc	0x200	46935a032af5e26a039c42e89a60387d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2e60a0	0x31c	data			0.44597989949748745
RT_MANIFEST	0x2e63bc	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/20/24-02:24:18.744560	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	57728	49943	70.166.167.38	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2024 02:24:04.335724115 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:04.335839987 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:04.335918903 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:04.348798990 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:04.348844051 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.057560921 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.057754993 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:05.062607050 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:05.062664986 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.063056946 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.128287077 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:05.168499947 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.237660885 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.237720966 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.237757921 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.237767935 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:05.237787962 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.237801075 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.237834930 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:05.237912893 CEST	443	49699	104.18.11.5	192.168.2.7
Jul 20, 2024 02:24:05.237960100 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:05.249231100 CEST	49699	443	192.168.2.7	104.18.11.5
Jul 20, 2024 02:24:05.371223927 CEST	49700	38930	192.168.2.7	23.105.170.33
Jul 20, 2024 02:24:05.371223927 CEST	49701	37209	192.168.2.7	190.12.95.170
Jul 20, 2024 02:24:05.371422052 CEST	49713	53197	192.168.2.7	132.148.167.243
Jul 20, 2024 02:24:05.371546984 CEST	49703	39078	192.168.2.7	198.8.94.174
Jul 20, 2024 02:24:05.371567011 CEST	49702	4145	192.168.2.7	199.116.114.11
Jul 20, 2024 02:24:05.371607065 CEST	49705	4145	192.168.2.7	184.181.217.213
Jul 20, 2024 02:24:05.371651888 CEST	49706	15062	192.168.2.7	51.81.31.64
Jul 20, 2024 02:24:05.371675014 CEST	49707	1080	192.168.2.7	109.120.222.90
Jul 20, 2024 02:24:05.371738911 CEST	49708	5678	192.168.2.7	177.104.87.23
Jul 20, 2024 02:24:05.371917963 CEST	49704	15722	192.168.2.7	195.154.43.198
Jul 20, 2024 02:24:05.372102022 CEST	49709	46104	192.168.2.7	98.103.88.158
Jul 20, 2024 02:24:05.372164011 CEST	49710	24093	192.168.2.7	115.73.130.122
Jul 20, 2024 02:24:05.372164011 CEST	49711	62909	192.168.2.7	173.212.205.144
Jul 20, 2024 02:24:05.372179031 CEST	49712	4153	192.168.2.7	177.85.157.25
Jul 20, 2024 02:24:05.373322964 CEST	49714	5678	192.168.2.7	85.89.184.87
Jul 20, 2024 02:24:05.374639034 CEST	49715	1080	192.168.2.7	1.179.148.33
Jul 20, 2024 02:24:05.375946045 CEST	49716	5678	192.168.2.7	46.231.72.35
Jul 20, 2024 02:24:05.378540993 CEST	49717	3373	192.168.2.7	199.233.238.6
Jul 20, 2024 02:24:05.378695011 CEST	38930	49700	23.105.170.33	192.168.2.7
Jul 20, 2024 02:24:05.378730059 CEST	37209	49701	190.12.95.170	192.168.2.7
Jul 20, 2024 02:24:05.378758907 CEST	53197	49713	132.148.167.243	192.168.2.7
Jul 20, 2024 02:24:05.378787041 CEST	39078	49703	198.8.94.174	192.168.2.7
Jul 20, 2024 02:24:05.378804922 CEST	49700	38930	192.168.2.7	23.105.170.33
Jul 20, 2024 02:24:05.378820896 CEST	49701	37209	192.168.2.7	190.12.95.170
Jul 20, 2024 02:24:05.378842115 CEST	4145	49702	199.116.114.11	192.168.2.7
Jul 20, 2024 02:24:05.378844976 CEST	49713	53197	192.168.2.7	132.148.167.243
Jul 20, 2024 02:24:05.378871918 CEST	49703	39078	192.168.2.7	198.8.94.174
Jul 20, 2024 02:24:05.378871918 CEST	4145	49705	184.181.217.213	192.168.2.7
Jul 20, 2024 02:24:05.378900051 CEST	49702	4145	192.168.2.7	199.116.114.11
Jul 20, 2024 02:24:05.378901005 CEST	15062	49706	51.81.31.64	192.168.2.7
Jul 20, 2024 02:24:05.378928900 CEST	49705	4145	192.168.2.7	184.181.217.213
Jul 20, 2024 02:24:05.378930092 CEST	1080	49707	109.120.222.90	192.168.2.7
Jul 20, 2024 02:24:05.378946066 CEST	49706	15062	192.168.2.7	51.81.31.64
Jul 20, 2024 02:24:05.378958941 CEST	5678	49708	177.104.87.23	192.168.2.7
Jul 20, 2024 02:24:05.378987074 CEST	15722	49704	195.154.43.198	192.168.2.7
Jul 20, 2024 02:24:05.378988028 CEST	49707	1080	192.168.2.7	109.120.222.90
Jul 20, 2024 02:24:05.379014969 CEST	46104	49709	98.103.88.158	192.168.2.7
Jul 20, 2024 02:24:05.379015923 CEST	49708	5678	192.168.2.7	177.104.87.23
Jul 20, 2024 02:24:05.379033089 CEST	49704	15722	192.168.2.7	195.154.43.198
Jul 20, 2024 02:24:05.379044056 CEST	4153	49712	177.85.157.25	192.168.2.7
Jul 20, 2024 02:24:05.379061937 CEST	49709	46104	192.168.2.7	98.103.88.158
Jul 20, 2024 02:24:05.379071951 CEST	24093	49710	115.73.130.122	192.168.2.7
Jul 20, 2024 02:24:05.379087925 CEST	49712	4153	192.168.2.7	177.85.157.25
Jul 20, 2024 02:24:05.379098892 CEST	62909	49711	173.212.205.144	192.168.2.7
Jul 20, 2024 02:24:05.379148960 CEST	49710	24093	192.168.2.7	115.73.130.122
Jul 20, 2024 02:24:05.379148960 CEST	49711	62909	192.168.2.7	173.212.205.144
Jul 20, 2024 02:24:05.379254103 CEST	5678	49714	85.89.184.87	192.168.2.7
Jul 20, 2024 02:24:05.379302979 CEST	49714	5678	192.168.2.7	85.89.184.87
Jul 20, 2024 02:24:05.379442930 CEST	1080	49715	1.179.148.33	192.168.2.7
Jul 20, 2024 02:24:05.379491091 CEST	49715	1080	192.168.2.7	1.179.148.33
Jul 20, 2024 02:24:05.381279945 CEST	5678	49716	46.231.72.35	192.168.2.7
Jul 20, 2024 02:24:05.381345987 CEST	49716	5678	192.168.2.7	46.231.72.35
Jul 20, 2024 02:24:05.382529974 CEST	49718	45028	192.168.2.7	95.111.227.164
Jul 20, 2024 02:24:05.383507013 CEST	3373	49717	199.233.238.6	192.168.2.7
Jul 20, 2024 02:24:05.383574009 CEST	49717	3373	192.168.2.7	199.233.238.6
Jul 20, 2024 02:24:05.384953022 CEST	49719	36835	192.168.2.7	188.173.14.99
Jul 20, 2024 02:24:05.387363911 CEST	45028	49718	95.111.227.164	192.168.2.7
Jul 20, 2024 02:24:05.387418032 CEST	49718	45028	192.168.2.7	95.111.227.164
Jul 20, 2024 02:24:05.389957905 CEST	36835	49719	188.173.14.99	192.168.2.7
Jul 20, 2024 02:24:05.390010118 CEST	49719	36835	192.168.2.7	188.173.14.99
Jul 20, 2024 02:24:05.395961046 CEST	49709	46104	192.168.2.7	98.103.88.158
Jul 20, 2024 02:24:05.396039963 CEST	49711	62909	192.168.2.7	173.212.205.144
Jul 20, 2024 02:24:05.396147966 CEST	49712	4153	192.168.2.7	177.85.157.25
Jul 20, 2024 02:24:05.396229029 CEST	49710	24093	192.168.2.7	115.73.130.122
Jul 20, 2024 02:24:05.396292925 CEST	49714	5678	192.168.2.7	85.89.184.87
Jul 20, 2024 02:24:05.396341085 CEST	49708	5678	192.168.2.7	177.104.87.23
Jul 20, 2024 02:24:05.396346092 CEST	49705	4145	192.168.2.7	184.181.217.213
Jul 20, 2024 02:24:05.396352053 CEST	49713	53197	192.168.2.7	132.148.167.243
Jul 20, 2024 02:24:05.396362066 CEST	49704	15722	192.168.2.7	195.154.43.198
Jul 20, 2024 02:24:05.396418095 CEST	49707	1080	192.168.2.7	109.120.222.90
Jul 20, 2024 02:24:05.396472931 CEST	49715	1080	192.168.2.7	1.179.148.33
Jul 20, 2024 02:24:05.396476030 CEST	49706	15062	192.168.2.7	51.81.31.64
Jul 20, 2024 02:24:05.396569967 CEST	49716	5678	192.168.2.7	46.231.72.35
Jul 20, 2024 02:24:05.396606922 CEST	49717	3373	192.168.2.7	199.233.238.6
Jul 20, 2024 02:24:05.396692038 CEST	49718	45028	192.168.2.7	95.111.227.164
Jul 20, 2024 02:24:05.396847010 CEST	49703	39078	192.168.2.7	198.8.94.174
Jul 20, 2024 02:24:05.396856070 CEST	49719	36835	192.168.2.7	188.173.14.99
Jul 20, 2024 02:24:05.396899939 CEST	49702	4145	192.168.2.7	199.116.114.11
Jul 20, 2024 02:24:05.396954060 CEST	49700	38930	192.168.2.7	23.105.170.33
Jul 20, 2024 02:24:05.396985054 CEST	49701	37209	192.168.2.7	190.12.95.170
Jul 20, 2024 02:24:05.397377968 CEST	49720	4145	192.168.2.7	190.108.84.168
Jul 20, 2024 02:24:05.398608923 CEST	49721	8259	192.168.2.7	147.124.212.31
Jul 20, 2024 02:24:05.399734020 CEST	49722	4145	192.168.2.7	168.227.158.65
Jul 20, 2024 02:24:05.400799990 CEST	46104	49709	98.103.88.158	192.168.2.7
Jul 20, 2024 02:24:05.400849104 CEST	62909	49711	173.212.205.144	192.168.2.7
Jul 20, 2024 02:24:05.400926113 CEST	4153	49712	177.85.157.25	192.168.2.7
Jul 20, 2024 02:24:05.401025057 CEST	24093	49710	115.73.130.122	192.168.2.7
Jul 20, 2024 02:24:05.401056051 CEST	5678	49714	85.89.184.87	192.168.2.7
Jul 20, 2024 02:24:05.401108980 CEST	4145	49705	184.181.217.213	192.168.2.7
Jul 20, 2024 02:24:05.401176929 CEST	5678	49708	177.104.87.23	192.168.2.7
Jul 20, 2024 02:24:05.401204109 CEST	15722	49704	195.154.43.198	192.168.2.7
Jul 20, 2024 02:24:05.401252031 CEST	53197	49713	132.148.167.243	192.168.2.7
Jul 20, 2024 02:24:05.401279926 CEST	1080	49707	109.120.222.90	192.168.2.7
Jul 20, 2024 02:24:05.401309967 CEST	1080	49715	1.179.148.33	192.168.2.7
Jul 20, 2024 02:24:05.401355982 CEST	15062	49706	51.81.31.64	192.168.2.7
Jul 20, 2024 02:24:05.401382923 CEST	5678	49716	46.231.72.35	192.168.2.7
Jul 20, 2024 02:24:05.401416063 CEST	49723	61912	192.168.2.7	161.97.163.52
Jul 20, 2024 02:24:05.401578903 CEST	3373	49717	199.233.238.6	192.168.2.7
Jul 20, 2024 02:24:05.401607037 CEST	45028	49718	95.111.227.164	192.168.2.7
Jul 20, 2024 02:24:05.401638985 CEST	39078	49703	198.8.94.174	192.168.2.7
Jul 20, 2024 02:24:05.401740074 CEST	36835	49719	188.173.14.99	192.168.2.7
Jul 20, 2024 02:24:05.401767015 CEST	4145	49702	199.116.114.11	192.168.2.7
Jul 20, 2024 02:24:05.401797056 CEST	38930	49700	23.105.170.33	192.168.2.7
Jul 20, 2024 02:24:05.401823997 CEST	37209	49701	190.12.95.170	192.168.2.7
Jul 20, 2024 02:24:05.402189016 CEST	4145	49720	190.108.84.168	192.168.2.7
Jul 20, 2024 02:24:05.402376890 CEST	49720	4145	192.168.2.7	190.108.84.168
Jul 20, 2024 02:24:05.402573109 CEST	49720	4145	192.168.2.7	190.108.84.168
Jul 20, 2024 02:24:05.403472900 CEST	8259	49721	147.124.212.31	192.168.2.7
Jul 20, 2024 02:24:05.403517962 CEST	49724	31703	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:05.403706074 CEST	49721	8259	192.168.2.7	147.124.212.31
Jul 20, 2024 02:24:05.403743029 CEST	49721	8259	192.168.2.7	147.124.212.31
Jul 20, 2024 02:24:05.404619932 CEST	4145	49722	168.227.158.65	192.168.2.7
Jul 20, 2024 02:24:05.404680967 CEST	49722	4145	192.168.2.7	168.227.158.65
Jul 20, 2024 02:24:05.404855967 CEST	49722	4145	192.168.2.7	168.227.158.65
Jul 20, 2024 02:24:05.405189037 CEST	49725	20347	192.168.2.7	72.10.160.90
Jul 20, 2024 02:24:05.406275034 CEST	61912	49723	161.97.163.52	192.168.2.7
Jul 20, 2024 02:24:05.406327009 CEST	49723	61912	192.168.2.7	161.97.163.52
Jul 20, 2024 02:24:05.406497002 CEST	49723	61912	192.168.2.7	161.97.163.52
Jul 20, 2024 02:24:05.407362938 CEST	4145	49720	190.108.84.168	192.168.2.7
Jul 20, 2024 02:24:05.407443047 CEST	49726	5678	192.168.2.7	103.87.81.86
Jul 20, 2024 02:24:05.408467054 CEST	31703	49724	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:05.408535004 CEST	49724	31703	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:05.408663988 CEST	8259	49721	147.124.212.31	192.168.2.7
Jul 20, 2024 02:24:05.408673048 CEST	49724	31703	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:05.408976078 CEST	49727	41739	192.168.2.7	154.12.253.232
Jul 20, 2024 02:24:05.409653902 CEST	4145	49722	168.227.158.65	192.168.2.7
Jul 20, 2024 02:24:05.410075903 CEST	20347	49725	72.10.160.90	192.168.2.7
Jul 20, 2024 02:24:05.410245895 CEST	49725	20347	192.168.2.7	72.10.160.90
Jul 20, 2024 02:24:05.410340071 CEST	49728	10243	192.168.2.7	47.252.20.42
Jul 20, 2024 02:24:05.410463095 CEST	49725	20347	192.168.2.7	72.10.160.90
Jul 20, 2024 02:24:05.411252022 CEST	61912	49723	161.97.163.52	192.168.2.7
Jul 20, 2024 02:24:05.411686897 CEST	49729	5678	192.168.2.7	83.235.22.245
Jul 20, 2024 02:24:05.412262917 CEST	5678	49726	103.87.81.86	192.168.2.7
Jul 20, 2024 02:24:05.412327051 CEST	49726	5678	192.168.2.7	103.87.81.86
Jul 20, 2024 02:24:05.412467957 CEST	49726	5678	192.168.2.7	103.87.81.86
Jul 20, 2024 02:24:05.412859917 CEST	49730	8080	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:05.413477898 CEST	31703	49724	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:05.413765907 CEST	49731	5678	192.168.2.7	202.69.38.42
Jul 20, 2024 02:24:05.413845062 CEST	41739	49727	154.12.253.232	192.168.2.7
Jul 20, 2024 02:24:05.413918018 CEST	49727	41739	192.168.2.7	154.12.253.232
Jul 20, 2024 02:24:05.414124012 CEST	49727	41739	192.168.2.7	154.12.253.232
Jul 20, 2024 02:24:05.415220976 CEST	10243	49728	47.252.20.42	192.168.2.7
Jul 20, 2024 02:24:05.415327072 CEST	49732	1080	192.168.2.7	162.216.204.146
Jul 20, 2024 02:24:05.415353060 CEST	20347	49725	72.10.160.90	192.168.2.7
Jul 20, 2024 02:24:05.415374994 CEST	49728	10243	192.168.2.7	47.252.20.42
Jul 20, 2024 02:24:05.415518045 CEST	49728	10243	192.168.2.7	47.252.20.42
Jul 20, 2024 02:24:05.416441917 CEST	5678	49729	83.235.22.245	192.168.2.7
Jul 20, 2024 02:24:05.416502953 CEST	49729	5678	192.168.2.7	83.235.22.245
Jul 20, 2024 02:24:05.416501999 CEST	49733	3128	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:05.416639090 CEST	49729	5678	192.168.2.7	83.235.22.245
Jul 20, 2024 02:24:05.417332888 CEST	5678	49726	103.87.81.86	192.168.2.7
Jul 20, 2024 02:24:05.417707920 CEST	8080	49730	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:05.417777061 CEST	49730	8080	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:05.417924881 CEST	49730	8080	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:05.418198109 CEST	49734	4145	192.168.2.7	98.170.57.231
Jul 20, 2024 02:24:05.418621063 CEST	5678	49731	202.69.38.42	192.168.2.7
Jul 20, 2024 02:24:05.418679953 CEST	49731	5678	192.168.2.7	202.69.38.42
Jul 20, 2024 02:24:05.418836117 CEST	49731	5678	192.168.2.7	202.69.38.42
Jul 20, 2024 02:24:05.418910027 CEST	41739	49727	154.12.253.232	192.168.2.7
Jul 20, 2024 02:24:05.419701099 CEST	49735	4153	192.168.2.7	103.81.117.225
Jul 20, 2024 02:24:05.420243979 CEST	1080	49732	162.216.204.146	192.168.2.7
Jul 20, 2024 02:24:05.420270920 CEST	10243	49728	47.252.20.42	192.168.2.7
Jul 20, 2024 02:24:05.420412064 CEST	49732	1080	192.168.2.7	162.216.204.146
Jul 20, 2024 02:24:05.420552015 CEST	49732	1080	192.168.2.7	162.216.204.146
Jul 20, 2024 02:24:05.421041965 CEST	49736	80	192.168.2.7	47.122.60.157
Jul 20, 2024 02:24:05.421469927 CEST	3128	49733	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:05.421498060 CEST	5678	49729	83.235.22.245	192.168.2.7
Jul 20, 2024 02:24:05.421581030 CEST	49733	3128	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:05.421729088 CEST	49733	3128	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:05.422532082 CEST	49737	8080	192.168.2.7	34.124.190.108
Jul 20, 2024 02:24:05.422696114 CEST	8080	49730	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:05.422980070 CEST	4145	49734	98.170.57.231	192.168.2.7
Jul 20, 2024 02:24:05.423047066 CEST	49734	4145	192.168.2.7	98.170.57.231
Jul 20, 2024 02:24:05.423190117 CEST	49734	4145	192.168.2.7	98.170.57.231
Jul 20, 2024 02:24:05.423587084 CEST	5678	49731	202.69.38.42	192.168.2.7
Jul 20, 2024 02:24:05.423924923 CEST	49738	58535	192.168.2.7	67.213.212.129
Jul 20, 2024 02:24:05.424602985 CEST	4153	49735	103.81.117.225	192.168.2.7
Jul 20, 2024 02:24:05.424973011 CEST	49735	4153	192.168.2.7	103.81.117.225
Jul 20, 2024 02:24:05.425015926 CEST	49735	4153	192.168.2.7	103.81.117.225
Jul 20, 2024 02:24:05.425358057 CEST	1080	49732	162.216.204.146	192.168.2.7
Jul 20, 2024 02:24:05.425685883 CEST	49739	8833	192.168.2.7	76.26.105.162
Jul 20, 2024 02:24:05.425892115 CEST	80	49736	47.122.60.157	192.168.2.7
Jul 20, 2024 02:24:05.425966024 CEST	49736	80	192.168.2.7	47.122.60.157
Jul 20, 2024 02:24:05.426139116 CEST	49736	80	192.168.2.7	47.122.60.157
Jul 20, 2024 02:24:05.426733971 CEST	3128	49733	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:05.427186012 CEST	49740	8080	192.168.2.7	139.180.169.114
Jul 20, 2024 02:24:05.427350998 CEST	8080	49737	34.124.190.108	192.168.2.7
Jul 20, 2024 02:24:05.427498102 CEST	49737	8080	192.168.2.7	34.124.190.108
Jul 20, 2024 02:24:05.427659035 CEST	49737	8080	192.168.2.7	34.124.190.108
Jul 20, 2024 02:24:05.427953959 CEST	4145	49734	98.170.57.231	192.168.2.7
Jul 20, 2024 02:24:05.428796053 CEST	58535	49738	67.213.212.129	192.168.2.7
Jul 20, 2024 02:24:05.428850889 CEST	49738	58535	192.168.2.7	67.213.212.129
Jul 20, 2024 02:24:05.428880930 CEST	49741	4145	192.168.2.7	199.102.106.94
Jul 20, 2024 02:24:05.429001093 CEST	49738	58535	192.168.2.7	67.213.212.129
Jul 20, 2024 02:24:05.429840088 CEST	4153	49735	103.81.117.225	192.168.2.7
Jul 20, 2024 02:24:05.430007935 CEST	49742	4145	192.168.2.7	98.170.57.249
Jul 20, 2024 02:24:05.430526972 CEST	8833	49739	76.26.105.162	192.168.2.7
Jul 20, 2024 02:24:05.430588961 CEST	49739	8833	192.168.2.7	76.26.105.162
Jul 20, 2024 02:24:05.430705070 CEST	49739	8833	192.168.2.7	76.26.105.162
Jul 20, 2024 02:24:05.430994987 CEST	80	49736	47.122.60.157	192.168.2.7
Jul 20, 2024 02:24:05.432097912 CEST	8080	49740	139.180.169.114	192.168.2.7
Jul 20, 2024 02:24:05.432238102 CEST	49740	8080	192.168.2.7	139.180.169.114
Jul 20, 2024 02:24:05.432369947 CEST	49740	8080	192.168.2.7	139.180.169.114
Jul 20, 2024 02:24:05.432456970 CEST	8080	49737	34.124.190.108	192.168.2.7
Jul 20, 2024 02:24:05.432651997 CEST	49743	4145	192.168.2.7	189.201.191.18
Jul 20, 2024 02:24:05.433501005 CEST	49744	4145	192.168.2.7	184.181.217.210
Jul 20, 2024 02:24:05.433734894 CEST	4145	49741	199.102.106.94	192.168.2.7
Jul 20, 2024 02:24:05.433824062 CEST	49741	4145	192.168.2.7	199.102.106.94
Jul 20, 2024 02:24:05.433856964 CEST	58535	49738	67.213.212.129	192.168.2.7
Jul 20, 2024 02:24:05.433969975 CEST	49741	4145	192.168.2.7	199.102.106.94
Jul 20, 2024 02:24:05.434823036 CEST	4145	49742	98.170.57.249	192.168.2.7
Jul 20, 2024 02:24:05.434895039 CEST	49745	14282	192.168.2.7	192.252.208.70
Jul 20, 2024 02:24:05.434912920 CEST	49742	4145	192.168.2.7	98.170.57.249
Jul 20, 2024 02:24:05.435075045 CEST	49742	4145	192.168.2.7	98.170.57.249
Jul 20, 2024 02:24:05.435497999 CEST	8833	49739	76.26.105.162	192.168.2.7
Jul 20, 2024 02:24:05.436136961 CEST	49746	4145	192.168.2.7	184.178.172.3
Jul 20, 2024 02:24:05.437190056 CEST	8080	49740	139.180.169.114	192.168.2.7
Jul 20, 2024 02:24:05.437396049 CEST	49747	4145	192.168.2.7	72.195.114.169
Jul 20, 2024 02:24:05.437566042 CEST	4145	49743	189.201.191.18	192.168.2.7
Jul 20, 2024 02:24:05.437968016 CEST	49743	4145	192.168.2.7	189.201.191.18
Jul 20, 2024 02:24:05.438245058 CEST	49743	4145	192.168.2.7	189.201.191.18
Jul 20, 2024 02:24:05.438329935 CEST	4145	49744	184.181.217.210	192.168.2.7
Jul 20, 2024 02:24:05.438384056 CEST	49744	4145	192.168.2.7	184.181.217.210
Jul 20, 2024 02:24:05.438520908 CEST	49744	4145	192.168.2.7	184.181.217.210
Jul 20, 2024 02:24:05.438750029 CEST	4145	49741	199.102.106.94	192.168.2.7
Jul 20, 2024 02:24:05.439290047 CEST	49748	1287	192.168.2.7	174.141.233.168
Jul 20, 2024 02:24:05.439840078 CEST	14282	49745	192.252.208.70	192.168.2.7
Jul 20, 2024 02:24:05.439867020 CEST	4145	49742	98.170.57.249	192.168.2.7
Jul 20, 2024 02:24:05.439939022 CEST	49745	14282	192.168.2.7	192.252.208.70
Jul 20, 2024 02:24:05.440082073 CEST	49745	14282	192.168.2.7	192.252.208.70
Jul 20, 2024 02:24:05.440717936 CEST	49749	59415	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:05.441001892 CEST	4145	49746	184.178.172.3	192.168.2.7
Jul 20, 2024 02:24:05.441077948 CEST	49746	4145	192.168.2.7	184.178.172.3
Jul 20, 2024 02:24:05.441274881 CEST	49746	4145	192.168.2.7	184.178.172.3
Jul 20, 2024 02:24:05.442234993 CEST	49750	570	192.168.2.7	104.239.80.124
Jul 20, 2024 02:24:05.442331076 CEST	4145	49747	72.195.114.169	192.168.2.7
Jul 20, 2024 02:24:05.442394018 CEST	49747	4145	192.168.2.7	72.195.114.169
Jul 20, 2024 02:24:05.442646027 CEST	49747	4145	192.168.2.7	72.195.114.169
Jul 20, 2024 02:24:05.443209887 CEST	4145	49743	189.201.191.18	192.168.2.7
Jul 20, 2024 02:24:05.443296909 CEST	4145	49744	184.181.217.210	192.168.2.7
Jul 20, 2024 02:24:05.443689108 CEST	49751	32688	192.168.2.7	64.124.191.98
Jul 20, 2024 02:24:05.444472075 CEST	1287	49748	174.141.233.168	192.168.2.7
Jul 20, 2024 02:24:05.444547892 CEST	49748	1287	192.168.2.7	174.141.233.168
Jul 20, 2024 02:24:05.444675922 CEST	49748	1287	192.168.2.7	174.141.233.168
Jul 20, 2024 02:24:05.444879055 CEST	14282	49745	192.252.208.70	192.168.2.7
Jul 20, 2024 02:24:05.445631027 CEST	59415	49749	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:05.445777893 CEST	49752	3128	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:05.445839882 CEST	49749	59415	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:05.445966005 CEST	49749	59415	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:05.446110010 CEST	4145	49746	184.178.172.3	192.168.2.7
Jul 20, 2024 02:24:05.447096109 CEST	570	49750	104.239.80.124	192.168.2.7
Jul 20, 2024 02:24:05.447165966 CEST	49750	570	192.168.2.7	104.239.80.124
Jul 20, 2024 02:24:05.447350025 CEST	49750	570	192.168.2.7	104.239.80.124
Jul 20, 2024 02:24:05.447396040 CEST	4145	49747	72.195.114.169	192.168.2.7
Jul 20, 2024 02:24:05.447669983 CEST	49753	60606	192.168.2.7	5.22.154.50
Jul 20, 2024 02:24:05.448585033 CEST	49754	4145	192.168.2.7	74.119.147.209
Jul 20, 2024 02:24:05.450603962 CEST	49755	18765	192.168.2.7	192.111.137.34
Jul 20, 2024 02:24:05.452306032 CEST	49756	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:05.456342936 CEST	49757	6666	192.168.2.7	14.225.62.76
Jul 20, 2024 02:24:05.457595110 CEST	49758	45314	192.168.2.7	104.238.100.115
Jul 20, 2024 02:24:05.458919048 CEST	49759	20679	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:05.459857941 CEST	49760	62979	192.168.2.7	66.23.233.210
Jul 20, 2024 02:24:05.462208986 CEST	49761	80	192.168.2.7	189.175.197.223
Jul 20, 2024 02:24:05.463675976 CEST	49762	8080	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:05.465948105 CEST	32688	49751	64.124.191.98	192.168.2.7
Jul 20, 2024 02:24:05.465965033 CEST	49763	16894	192.168.2.7	192.111.129.145
Jul 20, 2024 02:24:05.465977907 CEST	1287	49748	174.141.233.168	192.168.2.7
Jul 20, 2024 02:24:05.466006994 CEST	3128	49752	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:05.466013908 CEST	49751	32688	192.168.2.7	64.124.191.98
Jul 20, 2024 02:24:05.466034889 CEST	59415	49749	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:05.466056108 CEST	49752	3128	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:05.466063023 CEST	570	49750	104.239.80.124	192.168.2.7
Jul 20, 2024 02:24:05.466089964 CEST	60606	49753	5.22.154.50	192.168.2.7
Jul 20, 2024 02:24:05.466119051 CEST	4145	49754	74.119.147.209	192.168.2.7
Jul 20, 2024 02:24:05.466142893 CEST	49753	60606	192.168.2.7	5.22.154.50
Jul 20, 2024 02:24:05.466146946 CEST	18765	49755	192.111.137.34	192.168.2.7
Jul 20, 2024 02:24:05.466176033 CEST	57728	49756	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:05.466191053 CEST	49755	18765	192.168.2.7	192.111.137.34
Jul 20, 2024 02:24:05.466204882 CEST	6666	49757	14.225.62.76	192.168.2.7
Jul 20, 2024 02:24:05.466237068 CEST	45314	49758	104.238.100.115	192.168.2.7
Jul 20, 2024 02:24:05.466238976 CEST	49756	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:05.466264963 CEST	20679	49759	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:05.466268063 CEST	49754	4145	192.168.2.7	74.119.147.209
Jul 20, 2024 02:24:05.466268063 CEST	49757	6666	192.168.2.7	14.225.62.76
Jul 20, 2024 02:24:05.466293097 CEST	62979	49760	66.23.233.210	192.168.2.7
Jul 20, 2024 02:24:05.466345072 CEST	49760	62979	192.168.2.7	66.23.233.210
Jul 20, 2024 02:24:05.466351986 CEST	49759	20679	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:05.466413021 CEST	49758	45314	192.168.2.7	104.238.100.115
Jul 20, 2024 02:24:05.466726065 CEST	49751	32688	192.168.2.7	64.124.191.98
Jul 20, 2024 02:24:05.466815948 CEST	49755	18765	192.168.2.7	192.111.137.34
Jul 20, 2024 02:24:05.466902018 CEST	49756	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:05.467082024 CEST	49757	6666	192.168.2.7	14.225.62.76
Jul 20, 2024 02:24:05.467091084 CEST	49758	45314	192.168.2.7	104.238.100.115
Jul 20, 2024 02:24:05.467266083 CEST	49759	20679	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:05.467392921 CEST	49760	62979	192.168.2.7	66.23.233.210
Jul 20, 2024 02:24:05.467397928 CEST	49752	3128	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:05.467524052 CEST	49753	60606	192.168.2.7	5.22.154.50
Jul 20, 2024 02:24:05.467624903 CEST	49754	4145	192.168.2.7	74.119.147.209
Jul 20, 2024 02:24:05.467904091 CEST	80	49761	189.175.197.223	192.168.2.7
Jul 20, 2024 02:24:05.468077898 CEST	49761	80	192.168.2.7	189.175.197.223
Jul 20, 2024 02:24:05.468230009 CEST	49761	80	192.168.2.7	189.175.197.223
Jul 20, 2024 02:24:05.468569994 CEST	49764	24447	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:05.468579054 CEST	8080	49762	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:05.468633890 CEST	49762	8080	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:05.469031096 CEST	49762	8080	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:05.470104933 CEST	49765	32767	192.168.2.7	197.234.58.102
Jul 20, 2024 02:24:05.471059084 CEST	16894	49763	192.111.129.145	192.168.2.7
Jul 20, 2024 02:24:05.471155882 CEST	49766	80	192.168.2.7	93.158.155.18
Jul 20, 2024 02:24:05.471342087 CEST	49763	16894	192.168.2.7	192.111.129.145
Jul 20, 2024 02:24:05.471414089 CEST	49763	16894	192.168.2.7	192.111.129.145
Jul 20, 2024 02:24:05.472326040 CEST	32688	49751	64.124.191.98	192.168.2.7
Jul 20, 2024 02:24:05.472353935 CEST	18765	49755	192.111.137.34	192.168.2.7
Jul 20, 2024 02:24:05.472381115 CEST	57728	49756	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:05.472408056 CEST	6666	49757	14.225.62.76	192.168.2.7
Jul 20, 2024 02:24:05.472434998 CEST	45314	49758	104.238.100.115	192.168.2.7
Jul 20, 2024 02:24:05.472470045 CEST	49767	80	192.168.2.7	189.226.237.127
Jul 20, 2024 02:24:05.472497940 CEST	20679	49759	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:05.472543955 CEST	62979	49760	66.23.233.210	192.168.2.7
Jul 20, 2024 02:24:05.472569942 CEST	3128	49752	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:05.472596884 CEST	60606	49753	5.22.154.50	192.168.2.7
Jul 20, 2024 02:24:05.472624063 CEST	4145	49754	74.119.147.209	192.168.2.7
Jul 20, 2024 02:24:05.473134995 CEST	80	49761	189.175.197.223	192.168.2.7
Jul 20, 2024 02:24:05.473401070 CEST	24447	49764	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:05.473556042 CEST	49764	24447	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:05.473623991 CEST	49768	4145	192.168.2.7	199.187.210.54
Jul 20, 2024 02:24:05.473712921 CEST	49764	24447	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:05.473797083 CEST	8080	49762	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:05.474553108 CEST	49769	3128	192.168.2.7	47.104.27.165
Jul 20, 2024 02:24:05.474925041 CEST	32767	49765	197.234.58.102	192.168.2.7
Jul 20, 2024 02:24:05.474977970 CEST	49765	32767	192.168.2.7	197.234.58.102
Jul 20, 2024 02:24:05.475104094 CEST	49765	32767	192.168.2.7	197.234.58.102
Jul 20, 2024 02:24:05.475894928 CEST	49770	4145	192.168.2.7	78.133.163.190
Jul 20, 2024 02:24:05.475936890 CEST	80	49766	93.158.155.18	192.168.2.7
Jul 20, 2024 02:24:05.476011038 CEST	49766	80	192.168.2.7	93.158.155.18
Jul 20, 2024 02:24:05.476237059 CEST	16894	49763	192.111.129.145	192.168.2.7
Jul 20, 2024 02:24:05.476340055 CEST	49766	80	192.168.2.7	93.158.155.18
Jul 20, 2024 02:24:05.477418900 CEST	80	49767	189.226.237.127	192.168.2.7
Jul 20, 2024 02:24:05.477605104 CEST	49767	80	192.168.2.7	189.226.237.127
Jul 20, 2024 02:24:05.478235960 CEST	49771	5566	192.168.2.7	162.55.87.48
Jul 20, 2024 02:24:05.478406906 CEST	4145	49768	199.187.210.54	192.168.2.7
Jul 20, 2024 02:24:05.478487015 CEST	49768	4145	192.168.2.7	199.187.210.54
Jul 20, 2024 02:24:05.478535891 CEST	24447	49764	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:05.478847027 CEST	49767	80	192.168.2.7	189.226.237.127
Jul 20, 2024 02:24:05.479456902 CEST	3128	49769	47.104.27.165	192.168.2.7
Jul 20, 2024 02:24:05.479548931 CEST	49768	4145	192.168.2.7	199.187.210.54
Jul 20, 2024 02:24:05.479562044 CEST	49769	3128	192.168.2.7	47.104.27.165
Jul 20, 2024 02:24:05.479887962 CEST	32767	49765	197.234.58.102	192.168.2.7
Jul 20, 2024 02:24:05.479938030 CEST	49769	3128	192.168.2.7	47.104.27.165
Jul 20, 2024 02:24:05.480096102 CEST	49772	9080	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:05.480787992 CEST	4145	49770	78.133.163.190	192.168.2.7
Jul 20, 2024 02:24:05.480839014 CEST	49770	4145	192.168.2.7	78.133.163.190
Jul 20, 2024 02:24:05.481080055 CEST	49770	4145	192.168.2.7	78.133.163.190
Jul 20, 2024 02:24:05.481162071 CEST	80	49766	93.158.155.18	192.168.2.7
Jul 20, 2024 02:24:05.481264114 CEST	49773	5678	192.168.2.7	155.254.9.107
Jul 20, 2024 02:24:05.482034922 CEST	49774	4145	192.168.2.7	184.181.217.206
Jul 20, 2024 02:24:05.483036041 CEST	49775	8888	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:05.483073950 CEST	5566	49771	162.55.87.48	192.168.2.7
Jul 20, 2024 02:24:05.483130932 CEST	49771	5566	192.168.2.7	162.55.87.48
Jul 20, 2024 02:24:05.483269930 CEST	49771	5566	192.168.2.7	162.55.87.48
Jul 20, 2024 02:24:05.483675957 CEST	80	49767	189.226.237.127	192.168.2.7
Jul 20, 2024 02:24:05.483923912 CEST	49776	8800	192.168.2.7	8.130.54.67
Jul 20, 2024 02:24:05.484375954 CEST	4145	49768	199.187.210.54	192.168.2.7
Jul 20, 2024 02:24:05.484735966 CEST	3128	49769	47.104.27.165	192.168.2.7
Jul 20, 2024 02:24:05.484924078 CEST	49777	5678	192.168.2.7	201.221.134.74
Jul 20, 2024 02:24:05.484944105 CEST	9080	49772	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:05.485083103 CEST	49772	9080	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:05.485173941 CEST	49772	9080	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:05.485847950 CEST	4145	49770	78.133.163.190	192.168.2.7
Jul 20, 2024 02:24:05.485896111 CEST	49778	3128	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:05.486084938 CEST	5678	49773	155.254.9.107	192.168.2.7
Jul 20, 2024 02:24:05.486391068 CEST	49773	5678	192.168.2.7	155.254.9.107
Jul 20, 2024 02:24:05.486392021 CEST	49773	5678	192.168.2.7	155.254.9.107
Jul 20, 2024 02:24:05.486857891 CEST	4145	49774	184.181.217.206	192.168.2.7
Jul 20, 2024 02:24:05.486906052 CEST	49779	2454	192.168.2.7	103.174.178.147
Jul 20, 2024 02:24:05.486937046 CEST	49774	4145	192.168.2.7	184.181.217.206
Jul 20, 2024 02:24:05.487055063 CEST	49774	4145	192.168.2.7	184.181.217.206
Jul 20, 2024 02:24:05.487961054 CEST	8888	49775	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:05.487991095 CEST	49780	443	192.168.2.7	35.185.195.201
Jul 20, 2024 02:24:05.488049984 CEST	443	49780	35.185.195.201	192.168.2.7
Jul 20, 2024 02:24:05.488049984 CEST	5566	49771	162.55.87.48	192.168.2.7
Jul 20, 2024 02:24:05.488111973 CEST	49780	443	192.168.2.7	35.185.195.201
Jul 20, 2024 02:24:05.488137960 CEST	49775	8888	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:05.488204002 CEST	49775	8888	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:05.488280058 CEST	49780	443	192.168.2.7	35.185.195.201
Jul 20, 2024 02:24:05.488316059 CEST	443	49780	35.185.195.201	192.168.2.7
Jul 20, 2024 02:24:05.488362074 CEST	443	49780	35.185.195.201	192.168.2.7
Jul 20, 2024 02:24:05.488768101 CEST	8800	49776	8.130.54.67	192.168.2.7
Jul 20, 2024 02:24:05.489032984 CEST	49776	8800	192.168.2.7	8.130.54.67
Jul 20, 2024 02:24:05.489964962 CEST	49781	6000	192.168.2.7	39.101.65.228
Jul 20, 2024 02:24:05.490020990 CEST	5678	49777	201.221.134.74	192.168.2.7
Jul 20, 2024 02:24:05.490048885 CEST	9080	49772	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:05.490122080 CEST	49777	5678	192.168.2.7	201.221.134.74
Jul 20, 2024 02:24:05.490853071 CEST	3128	49778	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:05.490931988 CEST	49778	3128	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:05.491266012 CEST	49777	5678	192.168.2.7	201.221.134.74
Jul 20, 2024 02:24:05.491288900 CEST	5678	49773	155.254.9.107	192.168.2.7
Jul 20, 2024 02:24:05.491377115 CEST	49776	8800	192.168.2.7	8.130.54.67
Jul 20, 2024 02:24:05.491755962 CEST	2454	49779	103.174.178.147	192.168.2.7
Jul 20, 2024 02:24:05.491805077 CEST	4145	49774	184.181.217.206	192.168.2.7
Jul 20, 2024 02:24:05.491871119 CEST	49779	2454	192.168.2.7	103.174.178.147
Jul 20, 2024 02:24:05.492786884 CEST	49778	3128	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:05.492860079 CEST	49782	61358	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:05.492999077 CEST	49779	2454	192.168.2.7	103.174.178.147
Jul 20, 2024 02:24:05.493041992 CEST	8888	49775	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:05.494420052 CEST	49783	32100	192.168.2.7	50.250.205.21
Jul 20, 2024 02:24:05.494973898 CEST	6000	49781	39.101.65.228	192.168.2.7
Jul 20, 2024 02:24:05.495501995 CEST	49781	6000	192.168.2.7	39.101.65.228
Jul 20, 2024 02:24:05.496288061 CEST	5678	49777	201.221.134.74	192.168.2.7
Jul 20, 2024 02:24:05.496315002 CEST	8800	49776	8.130.54.67	192.168.2.7
Jul 20, 2024 02:24:05.497596979 CEST	3128	49778	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:05.497646093 CEST	61358	49782	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:05.497733116 CEST	49782	61358	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:05.497899055 CEST	2454	49779	103.174.178.147	192.168.2.7
Jul 20, 2024 02:24:05.499433994 CEST	32100	49783	50.250.205.21	192.168.2.7
Jul 20, 2024 02:24:05.499630928 CEST	49783	32100	192.168.2.7	50.250.205.21
Jul 20, 2024 02:24:05.501430035 CEST	49783	32100	192.168.2.7	50.250.205.21
Jul 20, 2024 02:24:05.502252102 CEST	49784	4145	192.168.2.7	68.1.210.163
Jul 20, 2024 02:24:05.503849030 CEST	49782	61358	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:05.503973007 CEST	49781	6000	192.168.2.7	39.101.65.228
Jul 20, 2024 02:24:05.506354094 CEST	32100	49783	50.250.205.21	192.168.2.7
Jul 20, 2024 02:24:05.507145882 CEST	4145	49784	68.1.210.163	192.168.2.7
Jul 20, 2024 02:24:05.507222891 CEST	49784	4145	192.168.2.7	68.1.210.163
Jul 20, 2024 02:24:05.508656979 CEST	61358	49782	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:05.508843899 CEST	6000	49781	39.101.65.228	192.168.2.7
Jul 20, 2024 02:24:05.509179115 CEST	49785	59391	192.168.2.7	181.143.106.162
Jul 20, 2024 02:24:05.509207964 CEST	49784	4145	192.168.2.7	68.1.210.163
Jul 20, 2024 02:24:05.510508060 CEST	49786	1080	192.168.2.7	102.219.33.118
Jul 20, 2024 02:24:05.511467934 CEST	49787	5678	192.168.2.7	91.247.92.63
Jul 20, 2024 02:24:05.513144970 CEST	49788	8081	192.168.2.7	47.122.56.158
Jul 20, 2024 02:24:05.513463020 CEST	49789	1080	192.168.2.7	135.148.139.151
Jul 20, 2024 02:24:05.514069080 CEST	59391	49785	181.143.106.162	192.168.2.7
Jul 20, 2024 02:24:05.514170885 CEST	4145	49784	68.1.210.163	192.168.2.7
Jul 20, 2024 02:24:05.514182091 CEST	49785	59391	192.168.2.7	181.143.106.162
Jul 20, 2024 02:24:05.514188051 CEST	49790	4145	192.168.2.7	184.170.249.65
Jul 20, 2024 02:24:05.514648914 CEST	49785	59391	192.168.2.7	181.143.106.162
Jul 20, 2024 02:24:05.515084982 CEST	49791	44909	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:05.515454054 CEST	1080	49786	102.219.33.118	192.168.2.7
Jul 20, 2024 02:24:05.515676022 CEST	49786	1080	192.168.2.7	102.219.33.118
Jul 20, 2024 02:24:05.515849113 CEST	49792	5678	192.168.2.7	142.166.131.50
Jul 20, 2024 02:24:05.515988111 CEST	49786	1080	192.168.2.7	102.219.33.118
Jul 20, 2024 02:24:05.516439915 CEST	5678	49787	91.247.92.63	192.168.2.7
Jul 20, 2024 02:24:05.516518116 CEST	49787	5678	192.168.2.7	91.247.92.63
Jul 20, 2024 02:24:05.516643047 CEST	49787	5678	192.168.2.7	91.247.92.63
Jul 20, 2024 02:24:05.517184973 CEST	49793	17328	192.168.2.7	192.252.220.92
Jul 20, 2024 02:24:05.517883062 CEST	49794	18081	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:05.517996073 CEST	8081	49788	47.122.56.158	192.168.2.7
Jul 20, 2024 02:24:05.518052101 CEST	49788	8081	192.168.2.7	47.122.56.158
Jul 20, 2024 02:24:05.518189907 CEST	49788	8081	192.168.2.7	47.122.56.158
Jul 20, 2024 02:24:05.518338919 CEST	1080	49789	135.148.139.151	192.168.2.7
Jul 20, 2024 02:24:05.518408060 CEST	49789	1080	192.168.2.7	135.148.139.151
Jul 20, 2024 02:24:05.518527985 CEST	49789	1080	192.168.2.7	135.148.139.151
Jul 20, 2024 02:24:05.518698931 CEST	49795	4145	192.168.2.7	183.6.7.103
Jul 20, 2024 02:24:05.519040108 CEST	4145	49790	184.170.249.65	192.168.2.7
Jul 20, 2024 02:24:05.519100904 CEST	49790	4145	192.168.2.7	184.170.249.65
Jul 20, 2024 02:24:05.519218922 CEST	49790	4145	192.168.2.7	184.170.249.65
Jul 20, 2024 02:24:05.519680023 CEST	49796	8081	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:05.519689083 CEST	59391	49785	181.143.106.162	192.168.2.7
Jul 20, 2024 02:24:05.520013094 CEST	44909	49791	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:05.520649910 CEST	49797	5678	192.168.2.7	196.216.13.36
Jul 20, 2024 02:24:05.520673990 CEST	49791	44909	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:05.520725965 CEST	5678	49792	142.166.131.50	192.168.2.7
Jul 20, 2024 02:24:05.520817995 CEST	49792	5678	192.168.2.7	142.166.131.50
Jul 20, 2024 02:24:05.520867109 CEST	1080	49786	102.219.33.118	192.168.2.7
Jul 20, 2024 02:24:05.520893097 CEST	49791	44909	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:05.521024942 CEST	49792	5678	192.168.2.7	142.166.131.50
Jul 20, 2024 02:24:05.521459103 CEST	5678	49787	91.247.92.63	192.168.2.7
Jul 20, 2024 02:24:05.522013903 CEST	49798	8118	192.168.2.7	114.215.127.92
Jul 20, 2024 02:24:05.522110939 CEST	17328	49793	192.252.220.92	192.168.2.7
Jul 20, 2024 02:24:05.522515059 CEST	49793	17328	192.168.2.7	192.252.220.92
Jul 20, 2024 02:24:05.522681952 CEST	49793	17328	192.168.2.7	192.252.220.92
Jul 20, 2024 02:24:05.522763968 CEST	18081	49794	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:05.522819042 CEST	49794	18081	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:05.522942066 CEST	49794	18081	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:05.522996902 CEST	8081	49788	47.122.56.158	192.168.2.7
Jul 20, 2024 02:24:05.523298025 CEST	49799	8080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:05.523313046 CEST	1080	49789	135.148.139.151	192.168.2.7
Jul 20, 2024 02:24:05.523504019 CEST	4145	49795	183.6.7.103	192.168.2.7
Jul 20, 2024 02:24:05.523708105 CEST	49795	4145	192.168.2.7	183.6.7.103
Jul 20, 2024 02:24:05.523839951 CEST	49795	4145	192.168.2.7	183.6.7.103
Jul 20, 2024 02:24:05.523932934 CEST	4145	49790	184.170.249.65	192.168.2.7
Jul 20, 2024 02:24:05.524266005 CEST	49800	9080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:05.524593115 CEST	8081	49796	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:05.524650097 CEST	49796	8081	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:05.524804115 CEST	49796	8081	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:05.525283098 CEST	49801	8081	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:05.525494099 CEST	5678	49797	196.216.13.36	192.168.2.7
Jul 20, 2024 02:24:05.525672913 CEST	49797	5678	192.168.2.7	196.216.13.36
Jul 20, 2024 02:24:05.525729895 CEST	44909	49791	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:05.526006937 CEST	5678	49792	142.166.131.50	192.168.2.7
Jul 20, 2024 02:24:05.526962996 CEST	8118	49798	114.215.127.92	192.168.2.7
Jul 20, 2024 02:24:05.527007103 CEST	49797	5678	192.168.2.7	196.216.13.36
Jul 20, 2024 02:24:05.527139902 CEST	49798	8118	192.168.2.7	114.215.127.92
Jul 20, 2024 02:24:05.527139902 CEST	49798	8118	192.168.2.7	114.215.127.92
Jul 20, 2024 02:24:05.527481079 CEST	17328	49793	192.252.220.92	192.168.2.7
Jul 20, 2024 02:24:05.527988911 CEST	18081	49794	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:05.528230906 CEST	8080	49799	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:05.528456926 CEST	49799	8080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:05.528671026 CEST	4145	49795	183.6.7.103	192.168.2.7
Jul 20, 2024 02:24:05.529129028 CEST	9080	49800	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:05.529194117 CEST	49799	8080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:05.529200077 CEST	49800	9080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:05.529443979 CEST	49800	9080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:05.529525995 CEST	8081	49796	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:05.530081987 CEST	8081	49801	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:05.530266047 CEST	49801	8081	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:05.530266047 CEST	49801	8081	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:05.531773090 CEST	5678	49797	196.216.13.36	192.168.2.7
Jul 20, 2024 02:24:05.531954050 CEST	8118	49798	114.215.127.92	192.168.2.7
Jul 20, 2024 02:24:05.534126997 CEST	8080	49799	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:05.534241915 CEST	9080	49800	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:05.535048962 CEST	8081	49801	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:05.794719934 CEST	46104	49709	98.103.88.158	192.168.2.7
Jul 20, 2024 02:24:05.796561956 CEST	49709	46104	192.168.2.7	98.103.88.158
Jul 20, 2024 02:24:05.800062895 CEST	49709	46104	192.168.2.7	98.103.88.158
Jul 20, 2024 02:24:05.804843903 CEST	46104	49709	98.103.88.158	192.168.2.7
Jul 20, 2024 02:24:05.957480907 CEST	39078	49703	198.8.94.174	192.168.2.7
Jul 20, 2024 02:24:05.957629919 CEST	49703	39078	192.168.2.7	198.8.94.174
Jul 20, 2024 02:24:05.957684040 CEST	49703	39078	192.168.2.7	198.8.94.174
Jul 20, 2024 02:24:05.962399006 CEST	39078	49703	198.8.94.174	192.168.2.7
Jul 20, 2024 02:24:05.962764978 CEST	39078	49703	198.8.94.174	192.168.2.7
Jul 20, 2024 02:24:05.962821007 CEST	49703	39078	192.168.2.7	198.8.94.174
Jul 20, 2024 02:24:05.993906975 CEST	4145	49702	199.116.114.11	192.168.2.7
Jul 20, 2024 02:24:05.994123936 CEST	49702	4145	192.168.2.7	199.116.114.11
Jul 20, 2024 02:24:05.994175911 CEST	49702	4145	192.168.2.7	199.116.114.11
Jul 20, 2024 02:24:05.996893883 CEST	4145	49705	184.181.217.213	192.168.2.7
Jul 20, 2024 02:24:05.998905897 CEST	4145	49702	199.116.114.11	192.168.2.7
Jul 20, 2024 02:24:05.999228954 CEST	4145	49702	199.116.114.11	192.168.2.7
Jul 20, 2024 02:24:05.999289989 CEST	49702	4145	192.168.2.7	199.116.114.11
Jul 20, 2024 02:24:06.003468037 CEST	49705	4145	192.168.2.7	184.181.217.213
Jul 20, 2024 02:24:06.003514051 CEST	49705	4145	192.168.2.7	184.181.217.213
Jul 20, 2024 02:24:06.004260063 CEST	49802	8081	192.168.2.7	137.141.148.79
Jul 20, 2024 02:24:06.008270979 CEST	4145	49705	184.181.217.213	192.168.2.7
Jul 20, 2024 02:24:06.008800030 CEST	4145	49705	184.181.217.213	192.168.2.7
Jul 20, 2024 02:24:06.008853912 CEST	49705	4145	192.168.2.7	184.181.217.213
Jul 20, 2024 02:24:06.009125948 CEST	8081	49802	137.141.148.79	192.168.2.7
Jul 20, 2024 02:24:06.009222984 CEST	49802	8081	192.168.2.7	137.141.148.79
Jul 20, 2024 02:24:06.012367010 CEST	4145	49734	98.170.57.231	192.168.2.7
Jul 20, 2024 02:24:06.017674923 CEST	49734	4145	192.168.2.7	98.170.57.231
Jul 20, 2024 02:24:06.017704964 CEST	49734	4145	192.168.2.7	98.170.57.231
Jul 20, 2024 02:24:06.025558949 CEST	4145	49734	98.170.57.231	192.168.2.7
Jul 20, 2024 02:24:06.035691977 CEST	4145	49741	199.102.106.94	192.168.2.7
Jul 20, 2024 02:24:06.036046982 CEST	4145	49734	98.170.57.231	192.168.2.7
Jul 20, 2024 02:24:06.036109924 CEST	49734	4145	192.168.2.7	98.170.57.231
Jul 20, 2024 02:24:06.037194967 CEST	49741	4145	192.168.2.7	199.102.106.94
Jul 20, 2024 02:24:06.037194967 CEST	49741	4145	192.168.2.7	199.102.106.94
Jul 20, 2024 02:24:06.038522959 CEST	4145	49746	184.178.172.3	192.168.2.7
Jul 20, 2024 02:24:06.041030884 CEST	4145	49744	184.181.217.210	192.168.2.7
Jul 20, 2024 02:24:06.042016983 CEST	4145	49741	199.102.106.94	192.168.2.7
Jul 20, 2024 02:24:06.042418003 CEST	4145	49741	199.102.106.94	192.168.2.7
Jul 20, 2024 02:24:06.042484045 CEST	49741	4145	192.168.2.7	199.102.106.94
Jul 20, 2024 02:24:06.043884039 CEST	49746	4145	192.168.2.7	184.178.172.3
Jul 20, 2024 02:24:06.044158936 CEST	49744	4145	192.168.2.7	184.181.217.210
Jul 20, 2024 02:24:06.044194937 CEST	49744	4145	192.168.2.7	184.181.217.210
Jul 20, 2024 02:24:06.044269085 CEST	49746	4145	192.168.2.7	184.178.172.3
Jul 20, 2024 02:24:06.047588110 CEST	4145	49742	98.170.57.249	192.168.2.7
Jul 20, 2024 02:24:06.047976017 CEST	49742	4145	192.168.2.7	98.170.57.249
Jul 20, 2024 02:24:06.048005104 CEST	49742	4145	192.168.2.7	98.170.57.249
Jul 20, 2024 02:24:06.048779011 CEST	4145	49746	184.178.172.3	192.168.2.7
Jul 20, 2024 02:24:06.048907042 CEST	4145	49744	184.181.217.210	192.168.2.7
Jul 20, 2024 02:24:06.049186945 CEST	4145	49744	184.181.217.210	192.168.2.7
Jul 20, 2024 02:24:06.049251080 CEST	49744	4145	192.168.2.7	184.181.217.210
Jul 20, 2024 02:24:06.049539089 CEST	4145	49746	184.178.172.3	192.168.2.7
Jul 20, 2024 02:24:06.052817106 CEST	4145	49742	98.170.57.249	192.168.2.7
Jul 20, 2024 02:24:06.052891970 CEST	49746	4145	192.168.2.7	184.178.172.3
Jul 20, 2024 02:24:06.053242922 CEST	4145	49742	98.170.57.249	192.168.2.7
Jul 20, 2024 02:24:06.053553104 CEST	49742	4145	192.168.2.7	98.170.57.249
Jul 20, 2024 02:24:06.053736925 CEST	4145	49747	72.195.114.169	192.168.2.7
Jul 20, 2024 02:24:06.054405928 CEST	49747	4145	192.168.2.7	72.195.114.169
Jul 20, 2024 02:24:06.054469109 CEST	49747	4145	192.168.2.7	72.195.114.169
Jul 20, 2024 02:24:06.059215069 CEST	4145	49747	72.195.114.169	192.168.2.7
Jul 20, 2024 02:24:06.059977055 CEST	4145	49747	72.195.114.169	192.168.2.7
Jul 20, 2024 02:24:06.060045004 CEST	49747	4145	192.168.2.7	72.195.114.169
Jul 20, 2024 02:24:06.060579062 CEST	49803	5678	192.168.2.7	196.43.106.62
Jul 20, 2024 02:24:06.060879946 CEST	49802	8081	192.168.2.7	137.141.148.79
Jul 20, 2024 02:24:06.062041044 CEST	49804	4145	192.168.2.7	72.210.252.137
Jul 20, 2024 02:24:06.063762903 CEST	49805	4145	192.168.2.7	24.249.199.12
Jul 20, 2024 02:24:06.065408945 CEST	5678	49803	196.43.106.62	192.168.2.7
Jul 20, 2024 02:24:06.065579891 CEST	49803	5678	192.168.2.7	196.43.106.62
Jul 20, 2024 02:24:06.065792084 CEST	8081	49802	137.141.148.79	192.168.2.7
Jul 20, 2024 02:24:06.066735983 CEST	49806	12139	192.168.2.7	166.0.235.197
Jul 20, 2024 02:24:06.066943884 CEST	4145	49804	72.210.252.137	192.168.2.7
Jul 20, 2024 02:24:06.067003012 CEST	49804	4145	192.168.2.7	72.210.252.137
Jul 20, 2024 02:24:06.067249060 CEST	49803	5678	192.168.2.7	196.43.106.62
Jul 20, 2024 02:24:06.068200111 CEST	49807	4145	192.168.2.7	104.200.152.30
Jul 20, 2024 02:24:06.068634033 CEST	4145	49805	24.249.199.12	192.168.2.7
Jul 20, 2024 02:24:06.068694115 CEST	49805	4145	192.168.2.7	24.249.199.12
Jul 20, 2024 02:24:06.068983078 CEST	49804	4145	192.168.2.7	72.210.252.137
Jul 20, 2024 02:24:06.070432901 CEST	49808	31287	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:06.070574999 CEST	49805	4145	192.168.2.7	24.249.199.12
Jul 20, 2024 02:24:06.071672916 CEST	12139	49806	166.0.235.197	192.168.2.7
Jul 20, 2024 02:24:06.071736097 CEST	49806	12139	192.168.2.7	166.0.235.197
Jul 20, 2024 02:24:06.072043896 CEST	5678	49803	196.43.106.62	192.168.2.7
Jul 20, 2024 02:24:06.073062897 CEST	4145	49807	104.200.152.30	192.168.2.7
Jul 20, 2024 02:24:06.073154926 CEST	49807	4145	192.168.2.7	104.200.152.30
Jul 20, 2024 02:24:06.073852062 CEST	4145	49804	72.210.252.137	192.168.2.7
Jul 20, 2024 02:24:06.074290991 CEST	49809	16002	192.168.2.7	107.180.90.88
Jul 20, 2024 02:24:06.074996948 CEST	49806	12139	192.168.2.7	166.0.235.197
Jul 20, 2024 02:24:06.075172901 CEST	49807	4145	192.168.2.7	104.200.152.30
Jul 20, 2024 02:24:06.075284958 CEST	31287	49808	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:06.075390100 CEST	4145	49805	24.249.199.12	192.168.2.7
Jul 20, 2024 02:24:06.075452089 CEST	49808	31287	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:06.076462030 CEST	49810	1628	192.168.2.7	181.214.152.204
Jul 20, 2024 02:24:06.076740026 CEST	49808	31287	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:06.077992916 CEST	57728	49756	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:06.078233957 CEST	49756	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:06.078263998 CEST	49756	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:06.079221964 CEST	16002	49809	107.180.90.88	192.168.2.7
Jul 20, 2024 02:24:06.079293966 CEST	49809	16002	192.168.2.7	107.180.90.88
Jul 20, 2024 02:24:06.079420090 CEST	49809	16002	192.168.2.7	107.180.90.88
Jul 20, 2024 02:24:06.079981089 CEST	12139	49806	166.0.235.197	192.168.2.7
Jul 20, 2024 02:24:06.080008984 CEST	4145	49807	104.200.152.30	192.168.2.7
Jul 20, 2024 02:24:06.081332922 CEST	1628	49810	181.214.152.204	192.168.2.7
Jul 20, 2024 02:24:06.081408024 CEST	49810	1628	192.168.2.7	181.214.152.204
Jul 20, 2024 02:24:06.081517935 CEST	31287	49808	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:06.081644058 CEST	49810	1628	192.168.2.7	181.214.152.204
Jul 20, 2024 02:24:06.083095074 CEST	57728	49756	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:06.083503008 CEST	57728	49756	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:06.083553076 CEST	49756	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:06.084213972 CEST	16002	49809	107.180.90.88	192.168.2.7
Jul 20, 2024 02:24:06.086440086 CEST	1628	49810	181.214.152.204	192.168.2.7
Jul 20, 2024 02:24:06.089493990 CEST	4145	49774	184.181.217.206	192.168.2.7
Jul 20, 2024 02:24:06.089751959 CEST	49774	4145	192.168.2.7	184.181.217.206
Jul 20, 2024 02:24:06.089752913 CEST	49774	4145	192.168.2.7	184.181.217.206
Jul 20, 2024 02:24:06.094829082 CEST	4145	49774	184.181.217.206	192.168.2.7
Jul 20, 2024 02:24:06.095107079 CEST	4145	49774	184.181.217.206	192.168.2.7
Jul 20, 2024 02:24:06.095350027 CEST	49774	4145	192.168.2.7	184.181.217.206
Jul 20, 2024 02:24:06.110605955 CEST	4145	49784	68.1.210.163	192.168.2.7
Jul 20, 2024 02:24:06.110821962 CEST	49784	4145	192.168.2.7	68.1.210.163
Jul 20, 2024 02:24:06.110822916 CEST	49784	4145	192.168.2.7	68.1.210.163
Jul 20, 2024 02:24:06.115689993 CEST	4145	49784	68.1.210.163	192.168.2.7
Jul 20, 2024 02:24:06.116687059 CEST	4145	49784	68.1.210.163	192.168.2.7
Jul 20, 2024 02:24:06.116841078 CEST	49784	4145	192.168.2.7	68.1.210.163
Jul 20, 2024 02:24:06.183507919 CEST	49811	5678	192.168.2.7	36.95.13.18
Jul 20, 2024 02:24:06.184391975 CEST	49812	80	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:06.185410976 CEST	49813	4145	192.168.2.7	198.8.84.3
Jul 20, 2024 02:24:06.191442966 CEST	5678	49811	36.95.13.18	192.168.2.7
Jul 20, 2024 02:24:06.191549063 CEST	49811	5678	192.168.2.7	36.95.13.18
Jul 20, 2024 02:24:06.191737890 CEST	49811	5678	192.168.2.7	36.95.13.18
Jul 20, 2024 02:24:06.192303896 CEST	80	49812	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:06.192529917 CEST	49812	80	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:06.192965984 CEST	49812	80	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:06.193191051 CEST	4145	49813	198.8.84.3	192.168.2.7
Jul 20, 2024 02:24:06.193367958 CEST	49813	4145	192.168.2.7	198.8.84.3
Jul 20, 2024 02:24:06.193497896 CEST	49813	4145	192.168.2.7	198.8.84.3
Jul 20, 2024 02:24:06.196751118 CEST	5678	49811	36.95.13.18	192.168.2.7
Jul 20, 2024 02:24:06.197786093 CEST	80	49812	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:06.198254108 CEST	4145	49813	198.8.84.3	192.168.2.7
Jul 20, 2024 02:24:06.334827900 CEST	32767	49765	197.234.58.102	192.168.2.7
Jul 20, 2024 02:24:06.335345030 CEST	49765	32767	192.168.2.7	197.234.58.102
Jul 20, 2024 02:24:06.335413933 CEST	49765	32767	192.168.2.7	197.234.58.102
Jul 20, 2024 02:24:06.340500116 CEST	32767	49765	197.234.58.102	192.168.2.7
Jul 20, 2024 02:24:06.341001987 CEST	32767	49765	197.234.58.102	192.168.2.7
Jul 20, 2024 02:24:06.341054916 CEST	49765	32767	192.168.2.7	197.234.58.102
Jul 20, 2024 02:24:06.405159950 CEST	49814	4145	192.168.2.7	72.37.216.68
Jul 20, 2024 02:24:06.410206079 CEST	4145	49814	72.37.216.68	192.168.2.7
Jul 20, 2024 02:24:06.410276890 CEST	49814	4145	192.168.2.7	72.37.216.68
Jul 20, 2024 02:24:06.416693926 CEST	49814	4145	192.168.2.7	72.37.216.68
Jul 20, 2024 02:24:06.421708107 CEST	4145	49814	72.37.216.68	192.168.2.7
Jul 20, 2024 02:24:06.429306984 CEST	5678	49797	196.216.13.36	192.168.2.7
Jul 20, 2024 02:24:06.429507017 CEST	49797	5678	192.168.2.7	196.216.13.36
Jul 20, 2024 02:24:06.429580927 CEST	49797	5678	192.168.2.7	196.216.13.36
Jul 20, 2024 02:24:06.434570074 CEST	5678	49797	196.216.13.36	192.168.2.7
Jul 20, 2024 02:24:06.511394978 CEST	49815	57070	192.168.2.7	203.96.177.211
Jul 20, 2024 02:24:06.516362906 CEST	57070	49815	203.96.177.211	192.168.2.7
Jul 20, 2024 02:24:06.516470909 CEST	49815	57070	192.168.2.7	203.96.177.211
Jul 20, 2024 02:24:06.516688108 CEST	49815	57070	192.168.2.7	203.96.177.211
Jul 20, 2024 02:24:06.521549940 CEST	57070	49815	203.96.177.211	192.168.2.7
Jul 20, 2024 02:24:06.650829077 CEST	4145	49804	72.210.252.137	192.168.2.7
Jul 20, 2024 02:24:06.650984049 CEST	49804	4145	192.168.2.7	72.210.252.137
Jul 20, 2024 02:24:06.651091099 CEST	49804	4145	192.168.2.7	72.210.252.137
Jul 20, 2024 02:24:06.655968904 CEST	4145	49804	72.210.252.137	192.168.2.7
Jul 20, 2024 02:24:06.656450987 CEST	4145	49804	72.210.252.137	192.168.2.7
Jul 20, 2024 02:24:06.656517982 CEST	49804	4145	192.168.2.7	72.210.252.137
Jul 20, 2024 02:24:06.670372009 CEST	4145	49768	199.187.210.54	192.168.2.7
Jul 20, 2024 02:24:06.670516968 CEST	49768	4145	192.168.2.7	199.187.210.54
Jul 20, 2024 02:24:06.670574903 CEST	49768	4145	192.168.2.7	199.187.210.54
Jul 20, 2024 02:24:06.675538063 CEST	4145	49768	199.187.210.54	192.168.2.7
Jul 20, 2024 02:24:06.675916910 CEST	4145	49768	199.187.210.54	192.168.2.7
Jul 20, 2024 02:24:06.675992012 CEST	49768	4145	192.168.2.7	199.187.210.54
Jul 20, 2024 02:24:06.676800013 CEST	4145	49805	24.249.199.12	192.168.2.7
Jul 20, 2024 02:24:06.676902056 CEST	49805	4145	192.168.2.7	24.249.199.12
Jul 20, 2024 02:24:06.676985025 CEST	49805	4145	192.168.2.7	24.249.199.12
Jul 20, 2024 02:24:06.681814909 CEST	4145	49805	24.249.199.12	192.168.2.7
Jul 20, 2024 02:24:06.682194948 CEST	4145	49805	24.249.199.12	192.168.2.7
Jul 20, 2024 02:24:06.682255983 CEST	49805	4145	192.168.2.7	24.249.199.12
Jul 20, 2024 02:24:06.730056047 CEST	49816	8080	192.168.2.7	8.211.195.173
Jul 20, 2024 02:24:06.730849028 CEST	49817	80	192.168.2.7	47.104.28.135
Jul 20, 2024 02:24:06.731686115 CEST	49818	6453	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:06.735117912 CEST	8080	49816	8.211.195.173	192.168.2.7
Jul 20, 2024 02:24:06.735209942 CEST	49816	8080	192.168.2.7	8.211.195.173
Jul 20, 2024 02:24:06.735404015 CEST	49816	8080	192.168.2.7	8.211.195.173
Jul 20, 2024 02:24:06.735678911 CEST	80	49817	47.104.28.135	192.168.2.7
Jul 20, 2024 02:24:06.735749960 CEST	49817	80	192.168.2.7	47.104.28.135
Jul 20, 2024 02:24:06.735901117 CEST	49817	80	192.168.2.7	47.104.28.135
Jul 20, 2024 02:24:06.736620903 CEST	6453	49818	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:06.736881018 CEST	49818	6453	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:06.736881971 CEST	49818	6453	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:06.740206957 CEST	8080	49816	8.211.195.173	192.168.2.7
Jul 20, 2024 02:24:06.741727114 CEST	80	49817	47.104.28.135	192.168.2.7
Jul 20, 2024 02:24:06.742939949 CEST	6453	49818	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:06.772037029 CEST	31287	49808	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:06.773050070 CEST	49808	31287	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:06.773185968 CEST	49808	31287	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:06.778012991 CEST	31287	49808	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:06.805347919 CEST	58535	49738	67.213.212.129	192.168.2.7
Jul 20, 2024 02:24:06.805417061 CEST	49738	58535	192.168.2.7	67.213.212.129
Jul 20, 2024 02:24:06.805558920 CEST	49738	58535	192.168.2.7	67.213.212.129
Jul 20, 2024 02:24:06.810329914 CEST	58535	49738	67.213.212.129	192.168.2.7
Jul 20, 2024 02:24:06.823127031 CEST	20347	49725	72.10.160.90	192.168.2.7
Jul 20, 2024 02:24:06.823223114 CEST	49725	20347	192.168.2.7	72.10.160.90
Jul 20, 2024 02:24:06.823354959 CEST	49725	20347	192.168.2.7	72.10.160.90
Jul 20, 2024 02:24:06.826699018 CEST	31703	49724	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:06.826761961 CEST	49724	31703	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:06.826868057 CEST	49724	31703	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:06.829678059 CEST	20347	49725	72.10.160.90	192.168.2.7
Jul 20, 2024 02:24:06.831728935 CEST	31703	49724	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:06.839832067 CEST	49819	40994	192.168.2.7	92.205.108.94
Jul 20, 2024 02:24:06.840631962 CEST	49820	9090	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:06.841485023 CEST	49821	55713	192.168.2.7	177.38.245.106
Jul 20, 2024 02:24:06.842317104 CEST	49822	4145	192.168.2.7	192.111.137.35
Jul 20, 2024 02:24:06.845098019 CEST	40994	49819	92.205.108.94	192.168.2.7
Jul 20, 2024 02:24:06.845177889 CEST	49819	40994	192.168.2.7	92.205.108.94
Jul 20, 2024 02:24:06.845365047 CEST	49819	40994	192.168.2.7	92.205.108.94
Jul 20, 2024 02:24:06.846153975 CEST	9090	49820	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:06.846210957 CEST	49820	9090	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:06.846332073 CEST	49820	9090	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:06.846838951 CEST	55713	49821	177.38.245.106	192.168.2.7
Jul 20, 2024 02:24:06.846894979 CEST	49821	55713	192.168.2.7	177.38.245.106
Jul 20, 2024 02:24:06.847127914 CEST	49821	55713	192.168.2.7	177.38.245.106
Jul 20, 2024 02:24:06.847691059 CEST	4145	49822	192.111.137.35	192.168.2.7
Jul 20, 2024 02:24:06.847748041 CEST	49822	4145	192.168.2.7	192.111.137.35
Jul 20, 2024 02:24:06.847872019 CEST	49822	4145	192.168.2.7	192.111.137.35
Jul 20, 2024 02:24:06.850265980 CEST	40994	49819	92.205.108.94	192.168.2.7
Jul 20, 2024 02:24:06.851705074 CEST	9090	49820	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:06.851977110 CEST	55713	49821	177.38.245.106	192.168.2.7
Jul 20, 2024 02:24:06.853140116 CEST	4145	49822	192.111.137.35	192.168.2.7
Jul 20, 2024 02:24:06.881921053 CEST	41739	49727	154.12.253.232	192.168.2.7
Jul 20, 2024 02:24:06.882093906 CEST	49727	41739	192.168.2.7	154.12.253.232
Jul 20, 2024 02:24:06.882093906 CEST	49727	41739	192.168.2.7	154.12.253.232
Jul 20, 2024 02:24:06.883872986 CEST	1287	49748	174.141.233.168	192.168.2.7
Jul 20, 2024 02:24:06.883991957 CEST	49748	1287	192.168.2.7	174.141.233.168
Jul 20, 2024 02:24:06.884093046 CEST	49748	1287	192.168.2.7	174.141.233.168
Jul 20, 2024 02:24:06.887265921 CEST	41739	49727	154.12.253.232	192.168.2.7
Jul 20, 2024 02:24:06.889000893 CEST	1287	49748	174.141.233.168	192.168.2.7
Jul 20, 2024 02:24:06.907661915 CEST	24447	49764	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:06.908174992 CEST	49764	24447	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:06.908175945 CEST	49764	24447	192.168.2.7	72.10.160.170
Jul 20, 2024 02:24:06.912184954 CEST	8259	49721	147.124.212.31	192.168.2.7
Jul 20, 2024 02:24:06.912283897 CEST	49721	8259	192.168.2.7	147.124.212.31
Jul 20, 2024 02:24:06.912461996 CEST	49721	8259	192.168.2.7	147.124.212.31
Jul 20, 2024 02:24:06.912578106 CEST	20679	49759	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:06.912645102 CEST	49759	20679	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:06.912769079 CEST	49759	20679	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:06.913301945 CEST	24447	49764	72.10.160.170	192.168.2.7
Jul 20, 2024 02:24:06.917404890 CEST	8259	49721	147.124.212.31	192.168.2.7
Jul 20, 2024 02:24:06.917653084 CEST	20679	49759	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:06.920094967 CEST	4145	49754	74.119.147.209	192.168.2.7
Jul 20, 2024 02:24:06.920223951 CEST	49754	4145	192.168.2.7	74.119.147.209
Jul 20, 2024 02:24:06.920274973 CEST	49754	4145	192.168.2.7	74.119.147.209
Jul 20, 2024 02:24:06.925174952 CEST	4145	49754	74.119.147.209	192.168.2.7
Jul 20, 2024 02:24:06.926397085 CEST	53197	49713	132.148.167.243	192.168.2.7
Jul 20, 2024 02:24:06.926476955 CEST	49713	53197	192.168.2.7	132.148.167.243
Jul 20, 2024 02:24:06.926559925 CEST	49713	53197	192.168.2.7	132.148.167.243
Jul 20, 2024 02:24:06.931427956 CEST	53197	49713	132.148.167.243	192.168.2.7
Jul 20, 2024 02:24:06.932444096 CEST	570	49750	104.239.80.124	192.168.2.7
Jul 20, 2024 02:24:06.932492018 CEST	49750	570	192.168.2.7	104.239.80.124
Jul 20, 2024 02:24:06.932595015 CEST	49750	570	192.168.2.7	104.239.80.124
Jul 20, 2024 02:24:06.937504053 CEST	570	49750	104.239.80.124	192.168.2.7
Jul 20, 2024 02:24:06.954030991 CEST	49823	4145	192.168.2.7	177.126.86.78
Jul 20, 2024 02:24:06.955451965 CEST	49824	4153	192.168.2.7	190.96.97.202
Jul 20, 2024 02:24:06.956945896 CEST	49825	4444	192.168.2.7	193.143.1.201
Jul 20, 2024 02:24:06.958393097 CEST	49826	1080	192.168.2.7	45.234.100.102
Jul 20, 2024 02:24:06.959455013 CEST	4145	49823	177.126.86.78	192.168.2.7
Jul 20, 2024 02:24:06.959542990 CEST	49823	4145	192.168.2.7	177.126.86.78
Jul 20, 2024 02:24:06.959808111 CEST	49827	57745	192.168.2.7	70.166.167.55
Jul 20, 2024 02:24:06.960184097 CEST	49823	4145	192.168.2.7	177.126.86.78
Jul 20, 2024 02:24:06.960592985 CEST	4153	49824	190.96.97.202	192.168.2.7
Jul 20, 2024 02:24:06.960674047 CEST	49824	4153	192.168.2.7	190.96.97.202
Jul 20, 2024 02:24:06.961213112 CEST	49828	32631	192.168.2.7	85.206.167.133
Jul 20, 2024 02:24:06.961647987 CEST	49824	4153	192.168.2.7	190.96.97.202
Jul 20, 2024 02:24:06.962358952 CEST	4444	49825	193.143.1.201	192.168.2.7
Jul 20, 2024 02:24:06.962431908 CEST	49825	4444	192.168.2.7	193.143.1.201
Jul 20, 2024 02:24:06.962779999 CEST	49829	8081	192.168.2.7	47.116.210.163
Jul 20, 2024 02:24:06.963074923 CEST	49825	4444	192.168.2.7	193.143.1.201
Jul 20, 2024 02:24:06.963321924 CEST	1080	49826	45.234.100.102	192.168.2.7
Jul 20, 2024 02:24:06.963512897 CEST	49826	1080	192.168.2.7	45.234.100.102
Jul 20, 2024 02:24:06.964915991 CEST	57745	49827	70.166.167.55	192.168.2.7
Jul 20, 2024 02:24:06.965106964 CEST	4145	49823	177.126.86.78	192.168.2.7
Jul 20, 2024 02:24:06.965184927 CEST	49827	57745	192.168.2.7	70.166.167.55
Jul 20, 2024 02:24:06.965540886 CEST	49830	3128	192.168.2.7	8.213.215.187
Jul 20, 2024 02:24:06.966217995 CEST	32631	49828	85.206.167.133	192.168.2.7
Jul 20, 2024 02:24:06.966399908 CEST	4145	49790	184.170.249.65	192.168.2.7
Jul 20, 2024 02:24:06.966444969 CEST	49828	32631	192.168.2.7	85.206.167.133
Jul 20, 2024 02:24:06.966473103 CEST	49790	4145	192.168.2.7	184.170.249.65
Jul 20, 2024 02:24:06.966603041 CEST	49790	4145	192.168.2.7	184.170.249.65
Jul 20, 2024 02:24:06.966610909 CEST	4153	49824	190.96.97.202	192.168.2.7
Jul 20, 2024 02:24:06.967664003 CEST	8081	49829	47.116.210.163	192.168.2.7
Jul 20, 2024 02:24:06.967919111 CEST	4444	49825	193.143.1.201	192.168.2.7
Jul 20, 2024 02:24:06.967991114 CEST	49829	8081	192.168.2.7	47.116.210.163
Jul 20, 2024 02:24:06.969459057 CEST	1080	49732	162.216.204.146	192.168.2.7
Jul 20, 2024 02:24:06.969531059 CEST	49732	1080	192.168.2.7	162.216.204.146
Jul 20, 2024 02:24:06.970549107 CEST	3128	49830	8.213.215.187	192.168.2.7
Jul 20, 2024 02:24:06.970623970 CEST	49830	3128	192.168.2.7	8.213.215.187
Jul 20, 2024 02:24:06.971458912 CEST	4145	49790	184.170.249.65	192.168.2.7
Jul 20, 2024 02:24:06.975485086 CEST	49732	1080	192.168.2.7	162.216.204.146
Jul 20, 2024 02:24:06.976316929 CEST	49826	1080	192.168.2.7	45.234.100.102
Jul 20, 2024 02:24:06.976607084 CEST	49830	3128	192.168.2.7	8.213.215.187
Jul 20, 2024 02:24:06.976807117 CEST	49827	57745	192.168.2.7	70.166.167.55
Jul 20, 2024 02:24:06.977406979 CEST	49828	32631	192.168.2.7	85.206.167.133
Jul 20, 2024 02:24:06.977454901 CEST	49829	8081	192.168.2.7	47.116.210.163
Jul 20, 2024 02:24:06.980428934 CEST	1080	49732	162.216.204.146	192.168.2.7
Jul 20, 2024 02:24:06.981467009 CEST	1080	49826	45.234.100.102	192.168.2.7
Jul 20, 2024 02:24:06.981496096 CEST	3128	49830	8.213.215.187	192.168.2.7
Jul 20, 2024 02:24:06.982291937 CEST	57745	49827	70.166.167.55	192.168.2.7
Jul 20, 2024 02:24:06.982321978 CEST	32631	49828	85.206.167.133	192.168.2.7
Jul 20, 2024 02:24:06.982352018 CEST	8081	49829	47.116.210.163	192.168.2.7
Jul 20, 2024 02:24:07.029666901 CEST	45314	49758	104.238.100.115	192.168.2.7
Jul 20, 2024 02:24:07.029742002 CEST	49758	45314	192.168.2.7	104.238.100.115
Jul 20, 2024 02:24:07.029850960 CEST	49758	45314	192.168.2.7	104.238.100.115
Jul 20, 2024 02:24:07.034774065 CEST	45314	49758	104.238.100.115	192.168.2.7
Jul 20, 2024 02:24:07.053581953 CEST	61358	49782	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:07.053651094 CEST	49782	61358	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:07.053756952 CEST	49782	61358	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:07.058517933 CEST	4145	49814	72.37.216.68	192.168.2.7
Jul 20, 2024 02:24:07.058610916 CEST	49814	4145	192.168.2.7	72.37.216.68
Jul 20, 2024 02:24:07.058682919 CEST	49814	4145	192.168.2.7	72.37.216.68
Jul 20, 2024 02:24:07.060286045 CEST	61358	49782	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:07.063570023 CEST	4145	49814	72.37.216.68	192.168.2.7
Jul 20, 2024 02:24:07.064076900 CEST	4145	49814	72.37.216.68	192.168.2.7
Jul 20, 2024 02:24:07.064127922 CEST	49814	4145	192.168.2.7	72.37.216.68
Jul 20, 2024 02:24:07.073915005 CEST	49831	80	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:07.075346947 CEST	49832	35559	192.168.2.7	213.16.81.182
Jul 20, 2024 02:24:07.076817036 CEST	49833	1865	192.168.2.7	67.43.227.226
Jul 20, 2024 02:24:07.077735901 CEST	49834	80	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:07.079058886 CEST	80	49831	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:07.079154015 CEST	49831	80	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:07.079256058 CEST	49835	41762	192.168.2.7	103.253.153.242
Jul 20, 2024 02:24:07.079871893 CEST	49831	80	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:07.080734015 CEST	35559	49832	213.16.81.182	192.168.2.7
Jul 20, 2024 02:24:07.080800056 CEST	49832	35559	192.168.2.7	213.16.81.182
Jul 20, 2024 02:24:07.081075907 CEST	49832	35559	192.168.2.7	213.16.81.182
Jul 20, 2024 02:24:07.082303047 CEST	1865	49833	67.43.227.226	192.168.2.7
Jul 20, 2024 02:24:07.082375050 CEST	49833	1865	192.168.2.7	67.43.227.226
Jul 20, 2024 02:24:07.082518101 CEST	49833	1865	192.168.2.7	67.43.227.226
Jul 20, 2024 02:24:07.082674980 CEST	80	49834	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:07.082766056 CEST	49834	80	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:07.083117008 CEST	49834	80	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:07.083265066 CEST	16894	49763	192.111.129.145	192.168.2.7
Jul 20, 2024 02:24:07.083508015 CEST	49763	16894	192.168.2.7	192.111.129.145
Jul 20, 2024 02:24:07.083547115 CEST	49763	16894	192.168.2.7	192.111.129.145
Jul 20, 2024 02:24:07.084592104 CEST	41762	49835	103.253.153.242	192.168.2.7
Jul 20, 2024 02:24:07.084675074 CEST	49835	41762	192.168.2.7	103.253.153.242
Jul 20, 2024 02:24:07.084793091 CEST	80	49831	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:07.084916115 CEST	49835	41762	192.168.2.7	103.253.153.242
Jul 20, 2024 02:24:07.086282015 CEST	35559	49832	213.16.81.182	192.168.2.7
Jul 20, 2024 02:24:07.087548971 CEST	1865	49833	67.43.227.226	192.168.2.7
Jul 20, 2024 02:24:07.088198900 CEST	80	49834	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:07.088608980 CEST	16894	49763	192.111.129.145	192.168.2.7
Jul 20, 2024 02:24:07.089205980 CEST	16894	49763	192.111.129.145	192.168.2.7
Jul 20, 2024 02:24:07.089262009 CEST	49763	16894	192.168.2.7	192.111.129.145
Jul 20, 2024 02:24:07.090837955 CEST	41762	49835	103.253.153.242	192.168.2.7
Jul 20, 2024 02:24:07.094484091 CEST	59415	49749	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:07.094551086 CEST	49749	59415	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:07.094638109 CEST	49749	59415	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:07.100876093 CEST	59415	49749	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:07.129010916 CEST	17328	49793	192.252.220.92	192.168.2.7
Jul 20, 2024 02:24:07.129060984 CEST	49793	17328	192.168.2.7	192.252.220.92
Jul 20, 2024 02:24:07.129148006 CEST	49793	17328	192.168.2.7	192.252.220.92
Jul 20, 2024 02:24:07.134459972 CEST	17328	49793	192.252.220.92	192.168.2.7
Jul 20, 2024 02:24:07.183475018 CEST	49836	4145	192.168.2.7	24.249.199.4
Jul 20, 2024 02:24:07.184024096 CEST	49837	8080	192.168.2.7	77.64.42.173
Jul 20, 2024 02:24:07.184556961 CEST	49838	3629	192.168.2.7	190.138.250.48
Jul 20, 2024 02:24:07.189699888 CEST	4145	49836	24.249.199.4	192.168.2.7
Jul 20, 2024 02:24:07.189721107 CEST	8080	49837	77.64.42.173	192.168.2.7
Jul 20, 2024 02:24:07.189739943 CEST	3629	49838	190.138.250.48	192.168.2.7
Jul 20, 2024 02:24:07.189770937 CEST	49836	4145	192.168.2.7	24.249.199.4
Jul 20, 2024 02:24:07.189798117 CEST	49837	8080	192.168.2.7	77.64.42.173
Jul 20, 2024 02:24:07.189863920 CEST	49838	3629	192.168.2.7	190.138.250.48
Jul 20, 2024 02:24:07.190110922 CEST	49836	4145	192.168.2.7	24.249.199.4
Jul 20, 2024 02:24:07.190136909 CEST	49837	8080	192.168.2.7	77.64.42.173
Jul 20, 2024 02:24:07.190184116 CEST	49838	3629	192.168.2.7	190.138.250.48
Jul 20, 2024 02:24:07.195337057 CEST	4145	49836	24.249.199.4	192.168.2.7
Jul 20, 2024 02:24:07.195353031 CEST	8080	49837	77.64.42.173	192.168.2.7
Jul 20, 2024 02:24:07.195369005 CEST	3629	49838	190.138.250.48	192.168.2.7
Jul 20, 2024 02:24:07.546907902 CEST	32631	49828	85.206.167.133	192.168.2.7
Jul 20, 2024 02:24:07.546972990 CEST	49828	32631	192.168.2.7	85.206.167.133
Jul 20, 2024 02:24:07.547103882 CEST	49828	32631	192.168.2.7	85.206.167.133
Jul 20, 2024 02:24:07.551903963 CEST	32631	49828	85.206.167.133	192.168.2.7
Jul 20, 2024 02:24:07.554878950 CEST	57745	49827	70.166.167.55	192.168.2.7
Jul 20, 2024 02:24:07.555094957 CEST	49827	57745	192.168.2.7	70.166.167.55
Jul 20, 2024 02:24:07.555094957 CEST	49827	57745	192.168.2.7	70.166.167.55
Jul 20, 2024 02:24:07.559987068 CEST	57745	49827	70.166.167.55	192.168.2.7
Jul 20, 2024 02:24:07.560595036 CEST	57745	49827	70.166.167.55	192.168.2.7
Jul 20, 2024 02:24:07.561163902 CEST	49827	57745	192.168.2.7	70.166.167.55
Jul 20, 2024 02:24:07.605107069 CEST	12139	49806	166.0.235.197	192.168.2.7
Jul 20, 2024 02:24:07.605204105 CEST	49806	12139	192.168.2.7	166.0.235.197
Jul 20, 2024 02:24:07.605341911 CEST	49806	12139	192.168.2.7	166.0.235.197
Jul 20, 2024 02:24:07.610122919 CEST	12139	49806	166.0.235.197	192.168.2.7
Jul 20, 2024 02:24:07.621504068 CEST	49839	16522	192.168.2.7	181.212.136.34
Jul 20, 2024 02:24:07.622157097 CEST	49840	26530	192.168.2.7	178.255.44.62
Jul 20, 2024 02:24:07.622596025 CEST	49841	61359	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:07.622725964 CEST	4153	49824	190.96.97.202	192.168.2.7
Jul 20, 2024 02:24:07.622859955 CEST	49824	4153	192.168.2.7	190.96.97.202
Jul 20, 2024 02:24:07.622929096 CEST	49824	4153	192.168.2.7	190.96.97.202
Jul 20, 2024 02:24:07.625536919 CEST	6666	49757	14.225.62.76	192.168.2.7
Jul 20, 2024 02:24:07.625627995 CEST	49757	6666	192.168.2.7	14.225.62.76
Jul 20, 2024 02:24:07.626368999 CEST	49757	6666	192.168.2.7	14.225.62.76
Jul 20, 2024 02:24:07.626405001 CEST	16522	49839	181.212.136.34	192.168.2.7
Jul 20, 2024 02:24:07.626507998 CEST	49839	16522	192.168.2.7	181.212.136.34
Jul 20, 2024 02:24:07.627093077 CEST	26530	49840	178.255.44.62	192.168.2.7
Jul 20, 2024 02:24:07.627168894 CEST	49840	26530	192.168.2.7	178.255.44.62
Jul 20, 2024 02:24:07.627449989 CEST	61359	49841	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:07.627500057 CEST	49839	16522	192.168.2.7	181.212.136.34
Jul 20, 2024 02:24:07.627599955 CEST	49841	61359	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:07.627715111 CEST	49840	26530	192.168.2.7	178.255.44.62
Jul 20, 2024 02:24:07.627737999 CEST	4153	49824	190.96.97.202	192.168.2.7
Jul 20, 2024 02:24:07.627763033 CEST	49841	61359	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:07.628046036 CEST	4153	49824	190.96.97.202	192.168.2.7
Jul 20, 2024 02:24:07.628200054 CEST	49824	4153	192.168.2.7	190.96.97.202
Jul 20, 2024 02:24:07.631181955 CEST	6666	49757	14.225.62.76	192.168.2.7
Jul 20, 2024 02:24:07.632375956 CEST	16522	49839	181.212.136.34	192.168.2.7
Jul 20, 2024 02:24:07.632530928 CEST	26530	49840	178.255.44.62	192.168.2.7
Jul 20, 2024 02:24:07.632982016 CEST	61359	49841	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:07.648963928 CEST	16002	49809	107.180.90.88	192.168.2.7
Jul 20, 2024 02:24:07.649252892 CEST	49809	16002	192.168.2.7	107.180.90.88
Jul 20, 2024 02:24:07.649452925 CEST	49809	16002	192.168.2.7	107.180.90.88
Jul 20, 2024 02:24:07.654313087 CEST	16002	49809	107.180.90.88	192.168.2.7
Jul 20, 2024 02:24:07.709721088 CEST	2454	49779	103.174.178.147	192.168.2.7
Jul 20, 2024 02:24:07.709791899 CEST	49779	2454	192.168.2.7	103.174.178.147
Jul 20, 2024 02:24:07.709964037 CEST	49779	2454	192.168.2.7	103.174.178.147
Jul 20, 2024 02:24:07.714883089 CEST	2454	49779	103.174.178.147	192.168.2.7
Jul 20, 2024 02:24:07.730477095 CEST	49842	56714	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:07.731101036 CEST	49843	38801	192.168.2.7	113.103.227.189
Jul 20, 2024 02:24:07.731976986 CEST	49844	44826	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:07.732172966 CEST	49845	10769	192.168.2.7	67.43.228.253
Jul 20, 2024 02:24:07.735512972 CEST	56714	49842	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:07.735601902 CEST	49842	56714	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:07.735771894 CEST	49842	56714	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:07.735904932 CEST	38801	49843	113.103.227.189	192.168.2.7
Jul 20, 2024 02:24:07.735961914 CEST	49843	38801	192.168.2.7	113.103.227.189
Jul 20, 2024 02:24:07.736061096 CEST	49843	38801	192.168.2.7	113.103.227.189
Jul 20, 2024 02:24:07.736814976 CEST	44826	49844	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:07.736948967 CEST	10769	49845	67.43.228.253	192.168.2.7
Jul 20, 2024 02:24:07.736973047 CEST	49844	44826	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:07.737082005 CEST	49845	10769	192.168.2.7	67.43.228.253
Jul 20, 2024 02:24:07.737157106 CEST	49844	44826	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:07.737252951 CEST	49845	10769	192.168.2.7	67.43.228.253
Jul 20, 2024 02:24:07.740617037 CEST	56714	49842	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:07.740863085 CEST	38801	49843	113.103.227.189	192.168.2.7
Jul 20, 2024 02:24:07.741863012 CEST	44826	49844	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:07.742165089 CEST	10769	49845	67.43.228.253	192.168.2.7
Jul 20, 2024 02:24:07.761387110 CEST	35559	49832	213.16.81.182	192.168.2.7
Jul 20, 2024 02:24:07.761482000 CEST	49832	35559	192.168.2.7	213.16.81.182
Jul 20, 2024 02:24:07.761507988 CEST	49832	35559	192.168.2.7	213.16.81.182
Jul 20, 2024 02:24:07.766287088 CEST	35559	49832	213.16.81.182	192.168.2.7
Jul 20, 2024 02:24:07.766762972 CEST	35559	49832	213.16.81.182	192.168.2.7
Jul 20, 2024 02:24:07.766808987 CEST	49832	35559	192.168.2.7	213.16.81.182
Jul 20, 2024 02:24:07.777230978 CEST	4145	49813	198.8.84.3	192.168.2.7
Jul 20, 2024 02:24:07.777488947 CEST	49813	4145	192.168.2.7	198.8.84.3
Jul 20, 2024 02:24:07.777488947 CEST	49813	4145	192.168.2.7	198.8.84.3
Jul 20, 2024 02:24:07.782615900 CEST	4145	49813	198.8.84.3	192.168.2.7
Jul 20, 2024 02:24:07.801476955 CEST	4145	49836	24.249.199.4	192.168.2.7
Jul 20, 2024 02:24:07.801664114 CEST	49836	4145	192.168.2.7	24.249.199.4
Jul 20, 2024 02:24:07.801664114 CEST	49836	4145	192.168.2.7	24.249.199.4
Jul 20, 2024 02:24:07.806301117 CEST	10243	49728	47.252.20.42	192.168.2.7
Jul 20, 2024 02:24:07.806534052 CEST	49728	10243	192.168.2.7	47.252.20.42
Jul 20, 2024 02:24:07.806538105 CEST	4145	49836	24.249.199.4	192.168.2.7
Jul 20, 2024 02:24:07.806567907 CEST	49728	10243	192.168.2.7	47.252.20.42
Jul 20, 2024 02:24:07.806916952 CEST	4145	49836	24.249.199.4	192.168.2.7
Jul 20, 2024 02:24:07.807101011 CEST	49836	4145	192.168.2.7	24.249.199.4
Jul 20, 2024 02:24:07.811423063 CEST	10243	49728	47.252.20.42	192.168.2.7
Jul 20, 2024 02:24:07.811949015 CEST	10243	49728	47.252.20.42	192.168.2.7
Jul 20, 2024 02:24:07.812166929 CEST	49728	10243	192.168.2.7	47.252.20.42
Jul 20, 2024 02:24:07.835099936 CEST	4145	49807	104.200.152.30	192.168.2.7
Jul 20, 2024 02:24:07.835206032 CEST	49807	4145	192.168.2.7	104.200.152.30
Jul 20, 2024 02:24:07.835251093 CEST	49807	4145	192.168.2.7	104.200.152.30
Jul 20, 2024 02:24:07.838876963 CEST	49846	51069	192.168.2.7	162.214.227.68
Jul 20, 2024 02:24:07.839122057 CEST	49847	80	192.168.2.7	142.138.80.36
Jul 20, 2024 02:24:07.839292049 CEST	49848	4153	192.168.2.7	182.253.146.155
Jul 20, 2024 02:24:07.839589119 CEST	49849	26425	192.168.2.7	72.10.164.178
Jul 20, 2024 02:24:07.839812040 CEST	49850	3128	192.168.2.7	47.90.149.238
Jul 20, 2024 02:24:07.840014935 CEST	49851	49923	192.168.2.7	186.219.96.47
Jul 20, 2024 02:24:07.840116024 CEST	4145	49807	104.200.152.30	192.168.2.7
Jul 20, 2024 02:24:07.840574980 CEST	4145	49807	104.200.152.30	192.168.2.7
Jul 20, 2024 02:24:07.840636015 CEST	49807	4145	192.168.2.7	104.200.152.30
Jul 20, 2024 02:24:07.843794107 CEST	51069	49846	162.214.227.68	192.168.2.7
Jul 20, 2024 02:24:07.843862057 CEST	49846	51069	192.168.2.7	162.214.227.68
Jul 20, 2024 02:24:07.844032049 CEST	49846	51069	192.168.2.7	162.214.227.68
Jul 20, 2024 02:24:07.844116926 CEST	80	49847	142.138.80.36	192.168.2.7
Jul 20, 2024 02:24:07.844208956 CEST	49847	80	192.168.2.7	142.138.80.36
Jul 20, 2024 02:24:07.844338894 CEST	49847	80	192.168.2.7	142.138.80.36
Jul 20, 2024 02:24:07.844475031 CEST	4153	49848	182.253.146.155	192.168.2.7
Jul 20, 2024 02:24:07.844537020 CEST	49848	4153	192.168.2.7	182.253.146.155
Jul 20, 2024 02:24:07.844643116 CEST	49848	4153	192.168.2.7	182.253.146.155
Jul 20, 2024 02:24:07.844943047 CEST	26425	49849	72.10.164.178	192.168.2.7
Jul 20, 2024 02:24:07.844959974 CEST	3128	49850	47.90.149.238	192.168.2.7
Jul 20, 2024 02:24:07.844975948 CEST	49923	49851	186.219.96.47	192.168.2.7
Jul 20, 2024 02:24:07.845067978 CEST	49850	3128	192.168.2.7	47.90.149.238
Jul 20, 2024 02:24:07.845125914 CEST	49849	26425	192.168.2.7	72.10.164.178
Jul 20, 2024 02:24:07.845211983 CEST	49850	3128	192.168.2.7	47.90.149.238
Jul 20, 2024 02:24:07.845292091 CEST	49851	49923	192.168.2.7	186.219.96.47
Jul 20, 2024 02:24:07.845292091 CEST	49849	26425	192.168.2.7	72.10.164.178
Jul 20, 2024 02:24:07.845292091 CEST	49851	49923	192.168.2.7	186.219.96.47
Jul 20, 2024 02:24:07.848818064 CEST	51069	49846	162.214.227.68	192.168.2.7
Jul 20, 2024 02:24:07.849123955 CEST	80	49847	142.138.80.36	192.168.2.7
Jul 20, 2024 02:24:07.849353075 CEST	4153	49848	182.253.146.155	192.168.2.7
Jul 20, 2024 02:24:07.850100994 CEST	3128	49850	47.90.149.238	192.168.2.7
Jul 20, 2024 02:24:07.850280046 CEST	26425	49849	72.10.164.178	192.168.2.7
Jul 20, 2024 02:24:07.850307941 CEST	49923	49851	186.219.96.47	192.168.2.7
Jul 20, 2024 02:24:07.914786100 CEST	8080	49730	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:07.914895058 CEST	49730	8080	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:07.914947987 CEST	49730	8080	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:07.919728041 CEST	8080	49730	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:07.920185089 CEST	8080	49730	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:07.920233011 CEST	49730	8080	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:07.981910944 CEST	3128	49752	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:07.982024908 CEST	49752	3128	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:07.982091904 CEST	49752	3128	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:07.986872911 CEST	3128	49752	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:07.987189054 CEST	3128	49752	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:07.987236023 CEST	49752	3128	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:08.030499935 CEST	8080	49799	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:08.030843019 CEST	49799	8080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:08.030955076 CEST	49799	8080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:08.034848928 CEST	9080	49800	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:08.034944057 CEST	49800	9080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:08.035007000 CEST	49800	9080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:08.035696983 CEST	8080	49799	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:08.036029100 CEST	8080	49799	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:08.036149025 CEST	49799	8080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:08.037242889 CEST	8081	49801	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:08.037343025 CEST	49801	8081	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:08.037343025 CEST	49801	8081	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:08.039805889 CEST	9080	49800	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:08.040549040 CEST	9080	49800	47.251.87.74	192.168.2.7
Jul 20, 2024 02:24:08.040615082 CEST	49800	9080	192.168.2.7	47.251.87.74
Jul 20, 2024 02:24:08.042166948 CEST	8081	49801	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:08.042642117 CEST	8081	49801	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:08.042682886 CEST	49801	8081	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:08.058204889 CEST	49852	1080	192.168.2.7	43.153.99.33
Jul 20, 2024 02:24:08.058469057 CEST	49853	53257	192.168.2.7	159.65.188.178
Jul 20, 2024 02:24:08.058707952 CEST	49854	31001	192.168.2.7	86.138.234.109
Jul 20, 2024 02:24:08.058865070 CEST	49855	1081	192.168.2.7	198.23.143.4
Jul 20, 2024 02:24:08.059206009 CEST	49856	4153	192.168.2.7	200.43.231.8
Jul 20, 2024 02:24:08.063093901 CEST	1080	49852	43.153.99.33	192.168.2.7
Jul 20, 2024 02:24:08.063169003 CEST	49852	1080	192.168.2.7	43.153.99.33
Jul 20, 2024 02:24:08.063321114 CEST	53257	49853	159.65.188.178	192.168.2.7
Jul 20, 2024 02:24:08.063360929 CEST	49852	1080	192.168.2.7	43.153.99.33
Jul 20, 2024 02:24:08.063388109 CEST	49853	53257	192.168.2.7	159.65.188.178
Jul 20, 2024 02:24:08.063504934 CEST	49853	53257	192.168.2.7	159.65.188.178
Jul 20, 2024 02:24:08.063571930 CEST	31001	49854	86.138.234.109	192.168.2.7
Jul 20, 2024 02:24:08.063599110 CEST	1081	49855	198.23.143.4	192.168.2.7
Jul 20, 2024 02:24:08.063632965 CEST	49854	31001	192.168.2.7	86.138.234.109
Jul 20, 2024 02:24:08.063661098 CEST	49855	1081	192.168.2.7	198.23.143.4
Jul 20, 2024 02:24:08.063787937 CEST	49854	31001	192.168.2.7	86.138.234.109
Jul 20, 2024 02:24:08.063831091 CEST	49855	1081	192.168.2.7	198.23.143.4
Jul 20, 2024 02:24:08.063977003 CEST	4153	49856	200.43.231.8	192.168.2.7
Jul 20, 2024 02:24:08.064047098 CEST	49856	4153	192.168.2.7	200.43.231.8
Jul 20, 2024 02:24:08.064182043 CEST	49856	4153	192.168.2.7	200.43.231.8
Jul 20, 2024 02:24:08.068306923 CEST	1080	49852	43.153.99.33	192.168.2.7
Jul 20, 2024 02:24:08.068407059 CEST	53257	49853	159.65.188.178	192.168.2.7
Jul 20, 2024 02:24:08.068656921 CEST	31001	49854	86.138.234.109	192.168.2.7
Jul 20, 2024 02:24:08.068672895 CEST	1081	49855	198.23.143.4	192.168.2.7
Jul 20, 2024 02:24:08.069026947 CEST	4153	49856	200.43.231.8	192.168.2.7
Jul 20, 2024 02:24:08.207532883 CEST	3128	49733	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:08.207798004 CEST	49733	3128	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:08.207880020 CEST	49733	3128	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:08.212701082 CEST	3128	49733	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:08.213103056 CEST	3128	49733	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:08.213176966 CEST	49733	3128	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:08.302450895 CEST	8080	49762	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:08.308389902 CEST	49762	8080	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:08.308389902 CEST	49762	8080	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:08.309920073 CEST	9080	49772	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:08.312971115 CEST	49772	9080	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:08.312971115 CEST	49772	9080	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:08.313329935 CEST	8080	49762	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:08.313939095 CEST	8080	49762	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:08.314007044 CEST	49762	8080	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:08.315272093 CEST	8081	49796	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:08.317851067 CEST	9080	49772	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:08.318238974 CEST	9080	49772	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:08.319199085 CEST	49772	9080	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:08.320158958 CEST	49796	8081	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:08.320205927 CEST	49796	8081	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:08.321295977 CEST	6453	49818	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:08.321523905 CEST	49818	6453	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:08.322231054 CEST	3128	49769	47.104.27.165	192.168.2.7
Jul 20, 2024 02:24:08.324223042 CEST	80	49736	47.122.60.157	192.168.2.7
Jul 20, 2024 02:24:08.324976921 CEST	8081	49796	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:08.325366020 CEST	8081	49796	8.220.141.8	192.168.2.7
Jul 20, 2024 02:24:08.327200890 CEST	49796	8081	192.168.2.7	8.220.141.8
Jul 20, 2024 02:24:08.343427896 CEST	3128	49778	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:08.345206022 CEST	49818	6453	192.168.2.7	107.180.88.173
Jul 20, 2024 02:24:08.348818064 CEST	49769	3128	192.168.2.7	47.104.27.165
Jul 20, 2024 02:24:08.348866940 CEST	49769	3128	192.168.2.7	47.104.27.165
Jul 20, 2024 02:24:08.349411964 CEST	49736	80	192.168.2.7	47.122.60.157
Jul 20, 2024 02:24:08.349762917 CEST	49736	80	192.168.2.7	47.122.60.157
Jul 20, 2024 02:24:08.350028038 CEST	6453	49818	107.180.88.173	192.168.2.7
Jul 20, 2024 02:24:08.350167036 CEST	49778	3128	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:08.350344896 CEST	49778	3128	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:08.353636026 CEST	3128	49769	47.104.27.165	192.168.2.7
Jul 20, 2024 02:24:08.354243994 CEST	3128	49769	47.104.27.165	192.168.2.7
Jul 20, 2024 02:24:08.354259968 CEST	80	49736	47.122.60.157	192.168.2.7
Jul 20, 2024 02:24:08.354305983 CEST	49769	3128	192.168.2.7	47.104.27.165
Jul 20, 2024 02:24:08.354518890 CEST	6000	49781	39.101.65.228	192.168.2.7
Jul 20, 2024 02:24:08.354681969 CEST	49781	6000	192.168.2.7	39.101.65.228
Jul 20, 2024 02:24:08.354763031 CEST	49781	6000	192.168.2.7	39.101.65.228
Jul 20, 2024 02:24:08.354831934 CEST	80	49736	47.122.60.157	192.168.2.7
Jul 20, 2024 02:24:08.354876995 CEST	49736	80	192.168.2.7	47.122.60.157
Jul 20, 2024 02:24:08.354939938 CEST	3128	49778	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:08.355348110 CEST	3128	49778	39.100.88.89	192.168.2.7
Jul 20, 2024 02:24:08.355393887 CEST	49778	3128	192.168.2.7	39.100.88.89
Jul 20, 2024 02:24:08.356610060 CEST	56714	49842	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:08.356786966 CEST	56714	49842	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:08.356841087 CEST	49842	56714	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:08.357017994 CEST	49842	56714	192.168.2.7	94.23.220.136
Jul 20, 2024 02:24:08.359498024 CEST	6000	49781	39.101.65.228	192.168.2.7
Jul 20, 2024 02:24:08.359771967 CEST	6000	49781	39.101.65.228	192.168.2.7
Jul 20, 2024 02:24:08.359894991 CEST	49781	6000	192.168.2.7	39.101.65.228
Jul 20, 2024 02:24:08.361835003 CEST	56714	49842	94.23.220.136	192.168.2.7
Jul 20, 2024 02:24:08.366553068 CEST	8800	49776	8.130.54.67	192.168.2.7
Jul 20, 2024 02:24:08.367394924 CEST	8888	49775	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:08.370138884 CEST	49776	8800	192.168.2.7	8.130.54.67
Jul 20, 2024 02:24:08.370213985 CEST	49776	8800	192.168.2.7	8.130.54.67
Jul 20, 2024 02:24:08.373491049 CEST	49775	8888	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:08.373522043 CEST	49775	8888	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:08.375041962 CEST	8800	49776	8.130.54.67	192.168.2.7
Jul 20, 2024 02:24:08.375418901 CEST	8800	49776	8.130.54.67	192.168.2.7
Jul 20, 2024 02:24:08.375490904 CEST	49776	8800	192.168.2.7	8.130.54.67
Jul 20, 2024 02:24:08.378293991 CEST	8888	49775	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:08.378690958 CEST	8888	49775	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:08.379199028 CEST	49775	8888	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:08.381719112 CEST	18081	49794	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:08.386776924 CEST	49794	18081	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:08.386868000 CEST	49794	18081	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:08.392242908 CEST	18081	49794	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:08.392678976 CEST	18081	49794	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:08.394783974 CEST	8118	49798	114.215.127.92	192.168.2.7
Jul 20, 2024 02:24:08.394841909 CEST	49794	18081	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:08.400777102 CEST	49798	8118	192.168.2.7	114.215.127.92
Jul 20, 2024 02:24:08.401108980 CEST	49798	8118	192.168.2.7	114.215.127.92
Jul 20, 2024 02:24:08.402049065 CEST	49857	5678	192.168.2.7	81.16.1.71
Jul 20, 2024 02:24:08.402734995 CEST	49858	59076	192.168.2.7	207.244.229.34
Jul 20, 2024 02:24:08.405184984 CEST	8081	49788	47.122.56.158	192.168.2.7
Jul 20, 2024 02:24:08.405657053 CEST	8118	49798	114.215.127.92	192.168.2.7
Jul 20, 2024 02:24:08.406112909 CEST	49788	8081	192.168.2.7	47.122.56.158
Jul 20, 2024 02:24:08.406150103 CEST	49788	8081	192.168.2.7	47.122.56.158
Jul 20, 2024 02:24:08.406214952 CEST	8118	49798	114.215.127.92	192.168.2.7
Jul 20, 2024 02:24:08.406258106 CEST	49798	8118	192.168.2.7	114.215.127.92
Jul 20, 2024 02:24:08.406995058 CEST	5678	49857	81.16.1.71	192.168.2.7
Jul 20, 2024 02:24:08.407058954 CEST	49857	5678	192.168.2.7	81.16.1.71
Jul 20, 2024 02:24:08.407615900 CEST	59076	49858	207.244.229.34	192.168.2.7
Jul 20, 2024 02:24:08.410996914 CEST	8081	49788	47.122.56.158	192.168.2.7
Jul 20, 2024 02:24:08.411067009 CEST	49858	59076	192.168.2.7	207.244.229.34
Jul 20, 2024 02:24:08.411570072 CEST	8081	49788	47.122.56.158	192.168.2.7
Jul 20, 2024 02:24:08.412170887 CEST	49788	8081	192.168.2.7	47.122.56.158
Jul 20, 2024 02:24:08.412888050 CEST	49857	5678	192.168.2.7	81.16.1.71
Jul 20, 2024 02:24:08.412911892 CEST	49859	4145	192.168.2.7	68.71.254.6
Jul 20, 2024 02:24:08.414055109 CEST	49858	59076	192.168.2.7	207.244.229.34
Jul 20, 2024 02:24:08.414377928 CEST	49860	49497	192.168.2.7	162.214.103.84
Jul 20, 2024 02:24:08.416640997 CEST	49861	7403	192.168.2.7	67.43.236.20
Jul 20, 2024 02:24:08.417725086 CEST	5678	49857	81.16.1.71	192.168.2.7
Jul 20, 2024 02:24:08.417743921 CEST	4145	49859	68.71.254.6	192.168.2.7
Jul 20, 2024 02:24:08.417903900 CEST	49859	4145	192.168.2.7	68.71.254.6
Jul 20, 2024 02:24:08.418854952 CEST	59076	49858	207.244.229.34	192.168.2.7
Jul 20, 2024 02:24:08.419138908 CEST	49862	5430	192.168.2.7	202.179.184.34
Jul 20, 2024 02:24:08.419275045 CEST	49497	49860	162.214.103.84	192.168.2.7
Jul 20, 2024 02:24:08.419451952 CEST	49860	49497	192.168.2.7	162.214.103.84
Jul 20, 2024 02:24:08.421447992 CEST	7403	49861	67.43.236.20	192.168.2.7
Jul 20, 2024 02:24:08.422341108 CEST	49861	7403	192.168.2.7	67.43.236.20
Jul 20, 2024 02:24:08.422601938 CEST	49859	4145	192.168.2.7	68.71.254.6
Jul 20, 2024 02:24:08.423084974 CEST	49863	44550	192.168.2.7	190.144.224.182
Jul 20, 2024 02:24:08.423407078 CEST	49860	49497	192.168.2.7	162.214.103.84
Jul 20, 2024 02:24:08.423612118 CEST	49861	7403	192.168.2.7	67.43.236.20
Jul 20, 2024 02:24:08.423913956 CEST	5430	49862	202.179.184.34	192.168.2.7
Jul 20, 2024 02:24:08.423981905 CEST	49862	5430	192.168.2.7	202.179.184.34
Jul 20, 2024 02:24:08.425214052 CEST	49864	4153	192.168.2.7	181.225.78.66
Jul 20, 2024 02:24:08.425611973 CEST	49862	5430	192.168.2.7	202.179.184.34
Jul 20, 2024 02:24:08.425847054 CEST	49865	56921	192.168.2.7	91.150.77.57
Jul 20, 2024 02:24:08.426434994 CEST	49866	10709	192.168.2.7	51.159.152.12
Jul 20, 2024 02:24:08.426620960 CEST	49867	5678	192.168.2.7	213.16.81.147
Jul 20, 2024 02:24:08.426780939 CEST	49868	1661	192.168.2.7	67.43.227.227
Jul 20, 2024 02:24:08.427009106 CEST	49869	22179	192.168.2.7	132.148.166.93
Jul 20, 2024 02:24:08.427136898 CEST	49870	30720	192.168.2.7	198.98.59.190
Jul 20, 2024 02:24:08.427422047 CEST	4145	49859	68.71.254.6	192.168.2.7
Jul 20, 2024 02:24:08.427869081 CEST	44550	49863	190.144.224.182	192.168.2.7
Jul 20, 2024 02:24:08.427942991 CEST	49863	44550	192.168.2.7	190.144.224.182
Jul 20, 2024 02:24:08.428072929 CEST	49863	44550	192.168.2.7	190.144.224.182
Jul 20, 2024 02:24:08.428111076 CEST	49497	49860	162.214.103.84	192.168.2.7
Jul 20, 2024 02:24:08.428423882 CEST	7403	49861	67.43.236.20	192.168.2.7
Jul 20, 2024 02:24:08.430047989 CEST	4153	49864	181.225.78.66	192.168.2.7
Jul 20, 2024 02:24:08.430107117 CEST	49864	4153	192.168.2.7	181.225.78.66
Jul 20, 2024 02:24:08.430247068 CEST	49864	4153	192.168.2.7	181.225.78.66
Jul 20, 2024 02:24:08.430361032 CEST	5430	49862	202.179.184.34	192.168.2.7
Jul 20, 2024 02:24:08.430671930 CEST	56921	49865	91.150.77.57	192.168.2.7
Jul 20, 2024 02:24:08.430722952 CEST	49865	56921	192.168.2.7	91.150.77.57
Jul 20, 2024 02:24:08.430872917 CEST	49865	56921	192.168.2.7	91.150.77.57
Jul 20, 2024 02:24:08.431294918 CEST	10709	49866	51.159.152.12	192.168.2.7
Jul 20, 2024 02:24:08.431375027 CEST	5678	49867	213.16.81.147	192.168.2.7
Jul 20, 2024 02:24:08.431432009 CEST	49866	10709	192.168.2.7	51.159.152.12
Jul 20, 2024 02:24:08.431489944 CEST	49867	5678	192.168.2.7	213.16.81.147
Jul 20, 2024 02:24:08.431593895 CEST	1661	49868	67.43.227.227	192.168.2.7
Jul 20, 2024 02:24:08.431648970 CEST	49868	1661	192.168.2.7	67.43.227.227
Jul 20, 2024 02:24:08.431694984 CEST	49866	10709	192.168.2.7	51.159.152.12
Jul 20, 2024 02:24:08.431771994 CEST	49868	1661	192.168.2.7	67.43.227.227
Jul 20, 2024 02:24:08.431775093 CEST	22179	49869	132.148.166.93	192.168.2.7
Jul 20, 2024 02:24:08.431860924 CEST	30720	49870	198.98.59.190	192.168.2.7
Jul 20, 2024 02:24:08.431891918 CEST	49867	5678	192.168.2.7	213.16.81.147
Jul 20, 2024 02:24:08.431906939 CEST	49869	22179	192.168.2.7	132.148.166.93
Jul 20, 2024 02:24:08.432002068 CEST	49870	30720	192.168.2.7	198.98.59.190
Jul 20, 2024 02:24:08.432039976 CEST	49869	22179	192.168.2.7	132.148.166.93
Jul 20, 2024 02:24:08.432090044 CEST	49870	30720	192.168.2.7	198.98.59.190
Jul 20, 2024 02:24:08.432806015 CEST	44550	49863	190.144.224.182	192.168.2.7
Jul 20, 2024 02:24:08.434994936 CEST	4153	49864	181.225.78.66	192.168.2.7
Jul 20, 2024 02:24:08.435946941 CEST	56921	49865	91.150.77.57	192.168.2.7
Jul 20, 2024 02:24:08.436467886 CEST	10709	49866	51.159.152.12	192.168.2.7
Jul 20, 2024 02:24:08.436595917 CEST	1661	49868	67.43.227.227	192.168.2.7
Jul 20, 2024 02:24:08.436640024 CEST	5678	49867	213.16.81.147	192.168.2.7
Jul 20, 2024 02:24:08.436916113 CEST	22179	49869	132.148.166.93	192.168.2.7
Jul 20, 2024 02:24:08.436942101 CEST	30720	49870	198.98.59.190	192.168.2.7
Jul 20, 2024 02:24:08.529208899 CEST	1865	49833	67.43.227.226	192.168.2.7
Jul 20, 2024 02:24:08.529278040 CEST	49833	1865	192.168.2.7	67.43.227.226
Jul 20, 2024 02:24:08.529431105 CEST	49833	1865	192.168.2.7	67.43.227.226
Jul 20, 2024 02:24:08.534403086 CEST	1865	49833	67.43.227.226	192.168.2.7
Jul 20, 2024 02:24:08.536087990 CEST	40994	49819	92.205.108.94	192.168.2.7
Jul 20, 2024 02:24:08.536156893 CEST	49819	40994	192.168.2.7	92.205.108.94
Jul 20, 2024 02:24:08.536254883 CEST	49819	40994	192.168.2.7	92.205.108.94
Jul 20, 2024 02:24:08.541382074 CEST	40994	49819	92.205.108.94	192.168.2.7
Jul 20, 2024 02:24:08.541930914 CEST	49871	14289	192.168.2.7	207.244.255.174
Jul 20, 2024 02:24:08.542051077 CEST	49872	80	192.168.2.7	178.20.45.29
Jul 20, 2024 02:24:08.545883894 CEST	57070	49815	203.96.177.211	192.168.2.7
Jul 20, 2024 02:24:08.546114922 CEST	49815	57070	192.168.2.7	203.96.177.211
Jul 20, 2024 02:24:08.546240091 CEST	49815	57070	192.168.2.7	203.96.177.211
Jul 20, 2024 02:24:08.546905994 CEST	14289	49871	207.244.255.174	192.168.2.7
Jul 20, 2024 02:24:08.546976089 CEST	49871	14289	192.168.2.7	207.244.255.174
Jul 20, 2024 02:24:08.547082901 CEST	80	49872	178.20.45.29	192.168.2.7
Jul 20, 2024 02:24:08.547161102 CEST	49871	14289	192.168.2.7	207.244.255.174
Jul 20, 2024 02:24:08.547193050 CEST	49872	80	192.168.2.7	178.20.45.29
Jul 20, 2024 02:24:08.547344923 CEST	49872	80	192.168.2.7	178.20.45.29
Jul 20, 2024 02:24:08.551084995 CEST	57070	49815	203.96.177.211	192.168.2.7
Jul 20, 2024 02:24:08.552165031 CEST	14289	49871	207.244.255.174	192.168.2.7
Jul 20, 2024 02:24:08.552465916 CEST	80	49872	178.20.45.29	192.168.2.7
Jul 20, 2024 02:24:08.651820898 CEST	49873	32755	192.168.2.7	154.68.43.182
Jul 20, 2024 02:24:08.657182932 CEST	32755	49873	154.68.43.182	192.168.2.7
Jul 20, 2024 02:24:08.657269955 CEST	49873	32755	192.168.2.7	154.68.43.182
Jul 20, 2024 02:24:08.663961887 CEST	49873	32755	192.168.2.7	154.68.43.182
Jul 20, 2024 02:24:08.668809891 CEST	32755	49873	154.68.43.182	192.168.2.7
Jul 20, 2024 02:24:08.711230040 CEST	80	49812	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:08.711364985 CEST	49812	80	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:08.711453915 CEST	49812	80	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:08.716279984 CEST	80	49812	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:08.717087984 CEST	80	49812	47.254.36.213	192.168.2.7
Jul 20, 2024 02:24:08.717137098 CEST	49812	80	192.168.2.7	47.254.36.213
Jul 20, 2024 02:24:08.735225916 CEST	4153	49856	200.43.231.8	192.168.2.7
Jul 20, 2024 02:24:08.735276937 CEST	49856	4153	192.168.2.7	200.43.231.8
Jul 20, 2024 02:24:08.735405922 CEST	49856	4153	192.168.2.7	200.43.231.8
Jul 20, 2024 02:24:08.740206003 CEST	4153	49856	200.43.231.8	192.168.2.7
Jul 20, 2024 02:24:08.761409044 CEST	49874	4145	192.168.2.7	200.214.154.135
Jul 20, 2024 02:24:08.761589050 CEST	49875	8080	192.168.2.7	95.216.194.176
Jul 20, 2024 02:24:08.766426086 CEST	4145	49874	200.214.154.135	192.168.2.7
Jul 20, 2024 02:24:08.766459942 CEST	8080	49875	95.216.194.176	192.168.2.7
Jul 20, 2024 02:24:08.766536951 CEST	49874	4145	192.168.2.7	200.214.154.135
Jul 20, 2024 02:24:08.766602993 CEST	49875	8080	192.168.2.7	95.216.194.176
Jul 20, 2024 02:24:08.767402887 CEST	49874	4145	192.168.2.7	200.214.154.135
Jul 20, 2024 02:24:08.767514944 CEST	49875	8080	192.168.2.7	95.216.194.176
Jul 20, 2024 02:24:08.772222996 CEST	4145	49874	200.214.154.135	192.168.2.7
Jul 20, 2024 02:24:08.772939920 CEST	8080	49875	95.216.194.176	192.168.2.7
Jul 20, 2024 02:24:09.001445055 CEST	14282	49745	192.252.208.70	192.168.2.7
Jul 20, 2024 02:24:09.004554033 CEST	49745	14282	192.168.2.7	192.252.208.70
Jul 20, 2024 02:24:09.004625082 CEST	49745	14282	192.168.2.7	192.252.208.70
Jul 20, 2024 02:24:09.009910107 CEST	14282	49745	192.252.208.70	192.168.2.7
Jul 20, 2024 02:24:09.010889053 CEST	14282	49745	192.252.208.70	192.168.2.7
Jul 20, 2024 02:24:09.010968924 CEST	49745	14282	192.168.2.7	192.252.208.70
Jul 20, 2024 02:24:09.028650045 CEST	1080	49789	135.148.139.151	192.168.2.7
Jul 20, 2024 02:24:09.028924942 CEST	49789	1080	192.168.2.7	135.148.139.151
Jul 20, 2024 02:24:09.028924942 CEST	49789	1080	192.168.2.7	135.148.139.151
Jul 20, 2024 02:24:09.036043882 CEST	1080	49789	135.148.139.151	192.168.2.7
Jul 20, 2024 02:24:09.038304090 CEST	1080	49789	135.148.139.151	192.168.2.7
Jul 20, 2024 02:24:09.038367033 CEST	49789	1080	192.168.2.7	135.148.139.151
Jul 20, 2024 02:24:09.038639069 CEST	4145	49859	68.71.254.6	192.168.2.7
Jul 20, 2024 02:24:09.038727999 CEST	49859	4145	192.168.2.7	68.71.254.6
Jul 20, 2024 02:24:09.038727999 CEST	49859	4145	192.168.2.7	68.71.254.6
Jul 20, 2024 02:24:09.045461893 CEST	4145	49859	68.71.254.6	192.168.2.7
Jul 20, 2024 02:24:09.047311068 CEST	4145	49859	68.71.254.6	192.168.2.7
Jul 20, 2024 02:24:09.047374010 CEST	49859	4145	192.168.2.7	68.71.254.6
Jul 20, 2024 02:24:09.059127092 CEST	10709	49866	51.159.152.12	192.168.2.7
Jul 20, 2024 02:24:09.059140921 CEST	10709	49866	51.159.152.12	192.168.2.7
Jul 20, 2024 02:24:09.059199095 CEST	49866	10709	192.168.2.7	51.159.152.12
Jul 20, 2024 02:24:09.059304953 CEST	49866	10709	192.168.2.7	51.159.152.12
Jul 20, 2024 02:24:09.068552971 CEST	5678	49714	85.89.184.87	192.168.2.7
Jul 20, 2024 02:24:09.068670034 CEST	49714	5678	192.168.2.7	85.89.184.87
Jul 20, 2024 02:24:09.068712950 CEST	49714	5678	192.168.2.7	85.89.184.87
Jul 20, 2024 02:24:09.076282978 CEST	5678	49714	85.89.184.87	192.168.2.7
Jul 20, 2024 02:24:09.077116013 CEST	5678	49714	85.89.184.87	192.168.2.7
Jul 20, 2024 02:24:09.077213049 CEST	49714	5678	192.168.2.7	85.89.184.87
Jul 20, 2024 02:24:09.078619957 CEST	5678	49773	155.254.9.107	192.168.2.7
Jul 20, 2024 02:24:09.078849077 CEST	49773	5678	192.168.2.7	155.254.9.107
Jul 20, 2024 02:24:09.078850031 CEST	49773	5678	192.168.2.7	155.254.9.107
Jul 20, 2024 02:24:09.084983110 CEST	5678	49773	155.254.9.107	192.168.2.7
Jul 20, 2024 02:24:09.086249113 CEST	5678	49773	155.254.9.107	192.168.2.7
Jul 20, 2024 02:24:09.086308956 CEST	49773	5678	192.168.2.7	155.254.9.107
Jul 20, 2024 02:24:09.089118958 CEST	49876	4145	192.168.2.7	72.195.34.42
Jul 20, 2024 02:24:09.089123011 CEST	49877	43581	192.168.2.7	162.214.154.141
Jul 20, 2024 02:24:09.089329004 CEST	49878	5678	192.168.2.7	103.10.99.110
Jul 20, 2024 02:24:09.089436054 CEST	49879	5678	192.168.2.7	154.79.250.48
Jul 20, 2024 02:24:09.089667082 CEST	49880	21597	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:09.089819908 CEST	49881	4153	192.168.2.7	1.9.27.219
Jul 20, 2024 02:24:09.094027042 CEST	4145	49876	72.195.34.42	192.168.2.7
Jul 20, 2024 02:24:09.094058990 CEST	43581	49877	162.214.154.141	192.168.2.7
Jul 20, 2024 02:24:09.094121933 CEST	49876	4145	192.168.2.7	72.195.34.42
Jul 20, 2024 02:24:09.094182968 CEST	5678	49878	103.10.99.110	192.168.2.7
Jul 20, 2024 02:24:09.094212055 CEST	49877	43581	192.168.2.7	162.214.154.141
Jul 20, 2024 02:24:09.094233990 CEST	49878	5678	192.168.2.7	103.10.99.110
Jul 20, 2024 02:24:09.094247103 CEST	5678	49879	154.79.250.48	192.168.2.7
Jul 20, 2024 02:24:09.094275951 CEST	49877	43581	192.168.2.7	162.214.154.141
Jul 20, 2024 02:24:09.094299078 CEST	49879	5678	192.168.2.7	154.79.250.48
Jul 20, 2024 02:24:09.094398975 CEST	49876	4145	192.168.2.7	72.195.34.42
Jul 20, 2024 02:24:09.094405890 CEST	21597	49880	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:09.094434023 CEST	49878	5678	192.168.2.7	103.10.99.110
Jul 20, 2024 02:24:09.094454050 CEST	49880	21597	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:09.094578028 CEST	49879	5678	192.168.2.7	154.79.250.48
Jul 20, 2024 02:24:09.094578028 CEST	49880	21597	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:09.094701052 CEST	4153	49881	1.9.27.219	192.168.2.7
Jul 20, 2024 02:24:09.094747066 CEST	49881	4153	192.168.2.7	1.9.27.219
Jul 20, 2024 02:24:09.094877005 CEST	49881	4153	192.168.2.7	1.9.27.219
Jul 20, 2024 02:24:09.099076986 CEST	43581	49877	162.214.154.141	192.168.2.7
Jul 20, 2024 02:24:09.099317074 CEST	4145	49876	72.195.34.42	192.168.2.7
Jul 20, 2024 02:24:09.099365950 CEST	5678	49878	103.10.99.110	192.168.2.7
Jul 20, 2024 02:24:09.099392891 CEST	5678	49879	154.79.250.48	192.168.2.7
Jul 20, 2024 02:24:09.099423885 CEST	21597	49880	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:09.099754095 CEST	4153	49881	1.9.27.219	192.168.2.7
Jul 20, 2024 02:24:09.143263102 CEST	10769	49845	67.43.228.253	192.168.2.7
Jul 20, 2024 02:24:09.143357038 CEST	49845	10769	192.168.2.7	67.43.228.253
Jul 20, 2024 02:24:09.143480062 CEST	49845	10769	192.168.2.7	67.43.228.253
Jul 20, 2024 02:24:09.150480032 CEST	10769	49845	67.43.228.253	192.168.2.7
Jul 20, 2024 02:24:09.198090076 CEST	49882	23988	192.168.2.7	170.106.76.24
Jul 20, 2024 02:24:09.204046965 CEST	23988	49882	170.106.76.24	192.168.2.7
Jul 20, 2024 02:24:09.204128027 CEST	49882	23988	192.168.2.7	170.106.76.24
Jul 20, 2024 02:24:09.204328060 CEST	49882	23988	192.168.2.7	170.106.76.24
Jul 20, 2024 02:24:09.209120035 CEST	23988	49882	170.106.76.24	192.168.2.7
Jul 20, 2024 02:24:09.254164934 CEST	26425	49849	72.10.164.178	192.168.2.7
Jul 20, 2024 02:24:09.254221916 CEST	49849	26425	192.168.2.7	72.10.164.178
Jul 20, 2024 02:24:09.254327059 CEST	49849	26425	192.168.2.7	72.10.164.178
Jul 20, 2024 02:24:09.256372929 CEST	8080	49816	8.211.195.173	192.168.2.7
Jul 20, 2024 02:24:09.256500006 CEST	49816	8080	192.168.2.7	8.211.195.173
Jul 20, 2024 02:24:09.256500006 CEST	49816	8080	192.168.2.7	8.211.195.173
Jul 20, 2024 02:24:09.259125948 CEST	26425	49849	72.10.164.178	192.168.2.7
Jul 20, 2024 02:24:09.261307955 CEST	8080	49816	8.211.195.173	192.168.2.7
Jul 20, 2024 02:24:09.261995077 CEST	8080	49816	8.211.195.173	192.168.2.7
Jul 20, 2024 02:24:09.262132883 CEST	49816	8080	192.168.2.7	8.211.195.173
Jul 20, 2024 02:24:09.308654070 CEST	49883	13697	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:09.309871912 CEST	49884	31476	192.168.2.7	170.244.64.12
Jul 20, 2024 02:24:09.314270020 CEST	13697	49883	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:09.314421892 CEST	49883	13697	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:09.314570904 CEST	49883	13697	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:09.315393925 CEST	31476	49884	170.244.64.12	192.168.2.7
Jul 20, 2024 02:24:09.315463066 CEST	49884	31476	192.168.2.7	170.244.64.12
Jul 20, 2024 02:24:09.315651894 CEST	49884	31476	192.168.2.7	170.244.64.12
Jul 20, 2024 02:24:09.319386959 CEST	13697	49883	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:09.320390940 CEST	31476	49884	170.244.64.12	192.168.2.7
Jul 20, 2024 02:24:09.374562979 CEST	5678	49731	202.69.38.42	192.168.2.7
Jul 20, 2024 02:24:09.374722958 CEST	49731	5678	192.168.2.7	202.69.38.42
Jul 20, 2024 02:24:09.374766111 CEST	49731	5678	192.168.2.7	202.69.38.42
Jul 20, 2024 02:24:09.380615950 CEST	5678	49731	202.69.38.42	192.168.2.7
Jul 20, 2024 02:24:09.381393909 CEST	5678	49731	202.69.38.42	192.168.2.7
Jul 20, 2024 02:24:09.381447077 CEST	49731	5678	192.168.2.7	202.69.38.42
Jul 20, 2024 02:24:09.416865110 CEST	49885	45764	192.168.2.7	162.214.162.156
Jul 20, 2024 02:24:09.416987896 CEST	49886	40736	192.168.2.7	138.255.240.66
Jul 20, 2024 02:24:09.421977997 CEST	45764	49885	162.214.162.156	192.168.2.7
Jul 20, 2024 02:24:09.421993971 CEST	40736	49886	138.255.240.66	192.168.2.7
Jul 20, 2024 02:24:09.422059059 CEST	49885	45764	192.168.2.7	162.214.162.156
Jul 20, 2024 02:24:09.422081947 CEST	49886	40736	192.168.2.7	138.255.240.66
Jul 20, 2024 02:24:09.422311068 CEST	49885	45764	192.168.2.7	162.214.162.156
Jul 20, 2024 02:24:09.422341108 CEST	49886	40736	192.168.2.7	138.255.240.66
Jul 20, 2024 02:24:09.427135944 CEST	45764	49885	162.214.162.156	192.168.2.7
Jul 20, 2024 02:24:09.427150011 CEST	40736	49886	138.255.240.66	192.168.2.7
Jul 20, 2024 02:24:09.448787928 CEST	16522	49839	181.212.136.34	192.168.2.7
Jul 20, 2024 02:24:09.448844910 CEST	49839	16522	192.168.2.7	181.212.136.34
Jul 20, 2024 02:24:09.448964119 CEST	49839	16522	192.168.2.7	181.212.136.34
Jul 20, 2024 02:24:09.449933052 CEST	53257	49853	159.65.188.178	192.168.2.7
Jul 20, 2024 02:24:09.449979067 CEST	49853	53257	192.168.2.7	159.65.188.178
Jul 20, 2024 02:24:09.450037003 CEST	49853	53257	192.168.2.7	159.65.188.178
Jul 20, 2024 02:24:09.453941107 CEST	16522	49839	181.212.136.34	192.168.2.7
Jul 20, 2024 02:24:09.454921961 CEST	53257	49853	159.65.188.178	192.168.2.7
Jul 20, 2024 02:24:09.526098967 CEST	49887	4145	192.168.2.7	104.37.135.145
Jul 20, 2024 02:24:09.531229973 CEST	4145	49887	104.37.135.145	192.168.2.7
Jul 20, 2024 02:24:09.531312943 CEST	49887	4145	192.168.2.7	104.37.135.145
Jul 20, 2024 02:24:09.531475067 CEST	49887	4145	192.168.2.7	104.37.135.145
Jul 20, 2024 02:24:09.536231041 CEST	4145	49887	104.37.135.145	192.168.2.7
Jul 20, 2024 02:24:09.579158068 CEST	80	49831	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:09.579257965 CEST	49831	80	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:09.579303026 CEST	49831	80	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:09.584050894 CEST	80	49831	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:09.584404945 CEST	80	49831	47.251.87.199	192.168.2.7
Jul 20, 2024 02:24:09.584449053 CEST	49831	80	192.168.2.7	47.251.87.199
Jul 20, 2024 02:24:09.616580009 CEST	80	49817	47.104.28.135	192.168.2.7
Jul 20, 2024 02:24:09.616669893 CEST	49817	80	192.168.2.7	47.104.28.135
Jul 20, 2024 02:24:09.616708994 CEST	49817	80	192.168.2.7	47.104.28.135
Jul 20, 2024 02:24:09.621510983 CEST	80	49817	47.104.28.135	192.168.2.7
Jul 20, 2024 02:24:09.622106075 CEST	80	49817	47.104.28.135	192.168.2.7
Jul 20, 2024 02:24:09.622145891 CEST	49817	80	192.168.2.7	47.104.28.135
Jul 20, 2024 02:24:09.635945082 CEST	49888	14287	192.168.2.7	192.252.208.67
Jul 20, 2024 02:24:09.636606932 CEST	49889	5678	192.168.2.7	46.219.1.5
Jul 20, 2024 02:24:09.639630079 CEST	1080	49852	43.153.99.33	192.168.2.7
Jul 20, 2024 02:24:09.639676094 CEST	49852	1080	192.168.2.7	43.153.99.33
Jul 20, 2024 02:24:09.639759064 CEST	49852	1080	192.168.2.7	43.153.99.33
Jul 20, 2024 02:24:09.640742064 CEST	14287	49888	192.252.208.67	192.168.2.7
Jul 20, 2024 02:24:09.640801907 CEST	49888	14287	192.168.2.7	192.252.208.67
Jul 20, 2024 02:24:09.641026974 CEST	49888	14287	192.168.2.7	192.252.208.67
Jul 20, 2024 02:24:09.641354084 CEST	5678	49889	46.219.1.5	192.168.2.7
Jul 20, 2024 02:24:09.641413927 CEST	49889	5678	192.168.2.7	46.219.1.5
Jul 20, 2024 02:24:09.641580105 CEST	49889	5678	192.168.2.7	46.219.1.5
Jul 20, 2024 02:24:09.644705057 CEST	1080	49852	43.153.99.33	192.168.2.7
Jul 20, 2024 02:24:09.646991014 CEST	14287	49888	192.252.208.67	192.168.2.7
Jul 20, 2024 02:24:09.647003889 CEST	5678	49889	46.219.1.5	192.168.2.7
Jul 20, 2024 02:24:09.715143919 CEST	4145	49876	72.195.34.42	192.168.2.7
Jul 20, 2024 02:24:09.715253115 CEST	49876	4145	192.168.2.7	72.195.34.42
Jul 20, 2024 02:24:09.715344906 CEST	49876	4145	192.168.2.7	72.195.34.42
Jul 20, 2024 02:24:09.720532894 CEST	4145	49876	72.195.34.42	192.168.2.7
Jul 20, 2024 02:24:09.721688986 CEST	4145	49876	72.195.34.42	192.168.2.7
Jul 20, 2024 02:24:09.721730947 CEST	49876	4145	192.168.2.7	72.195.34.42
Jul 20, 2024 02:24:09.735054016 CEST	9090	49820	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:09.735171080 CEST	49820	9090	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:09.735215902 CEST	49820	9090	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:09.744915009 CEST	49890	23087	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:09.745172024 CEST	49891	31948	192.168.2.7	1.179.151.165
Jul 20, 2024 02:24:09.745275021 CEST	49892	34159	192.168.2.7	77.65.50.118
Jul 20, 2024 02:24:09.750595093 CEST	9090	49820	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:09.751313925 CEST	9090	49820	8.130.39.117	192.168.2.7
Jul 20, 2024 02:24:09.751374006 CEST	49820	9090	192.168.2.7	8.130.39.117
Jul 20, 2024 02:24:09.757687092 CEST	23087	49890	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:09.757786989 CEST	49890	23087	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:09.757886887 CEST	31948	49891	1.179.151.165	192.168.2.7
Jul 20, 2024 02:24:09.757955074 CEST	49891	31948	192.168.2.7	1.179.151.165
Jul 20, 2024 02:24:09.758037090 CEST	34159	49892	77.65.50.118	192.168.2.7
Jul 20, 2024 02:24:09.758063078 CEST	49890	23087	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:09.758141041 CEST	49892	34159	192.168.2.7	77.65.50.118
Jul 20, 2024 02:24:09.758198023 CEST	49891	31948	192.168.2.7	1.179.151.165
Jul 20, 2024 02:24:09.758325100 CEST	49892	34159	192.168.2.7	77.65.50.118
Jul 20, 2024 02:24:09.764839888 CEST	23087	49890	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:09.764873981 CEST	31948	49891	1.179.151.165	192.168.2.7
Jul 20, 2024 02:24:09.764904022 CEST	34159	49892	77.65.50.118	192.168.2.7
Jul 20, 2024 02:24:09.777667999 CEST	38801	49843	113.103.227.189	192.168.2.7
Jul 20, 2024 02:24:09.777735949 CEST	49843	38801	192.168.2.7	113.103.227.189
Jul 20, 2024 02:24:09.777839899 CEST	49843	38801	192.168.2.7	113.103.227.189
Jul 20, 2024 02:24:09.785651922 CEST	38801	49843	113.103.227.189	192.168.2.7
Jul 20, 2024 02:24:09.807801008 CEST	21597	49880	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:09.807884932 CEST	49880	21597	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:09.807976961 CEST	49880	21597	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:09.812477112 CEST	23988	49882	170.106.76.24	192.168.2.7
Jul 20, 2024 02:24:09.812633991 CEST	23988	49882	170.106.76.24	192.168.2.7
Jul 20, 2024 02:24:09.812639952 CEST	49882	23988	192.168.2.7	170.106.76.24
Jul 20, 2024 02:24:09.812761068 CEST	21597	49880	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:09.812762022 CEST	49882	23988	192.168.2.7	170.106.76.24
Jul 20, 2024 02:24:09.827712059 CEST	30720	49870	198.98.59.190	192.168.2.7
Jul 20, 2024 02:24:09.827769995 CEST	49870	30720	192.168.2.7	198.98.59.190
Jul 20, 2024 02:24:09.827842951 CEST	49870	30720	192.168.2.7	198.98.59.190
Jul 20, 2024 02:24:09.833939075 CEST	30720	49870	198.98.59.190	192.168.2.7
Jul 20, 2024 02:24:09.854443073 CEST	3128	49830	8.213.215.187	192.168.2.7
Jul 20, 2024 02:24:09.854547977 CEST	49830	3128	192.168.2.7	8.213.215.187
Jul 20, 2024 02:24:09.854607105 CEST	49830	3128	192.168.2.7	8.213.215.187
Jul 20, 2024 02:24:09.854684114 CEST	49893	80	192.168.2.7	104.24.69.32
Jul 20, 2024 02:24:09.854872942 CEST	8081	49829	47.116.210.163	192.168.2.7
Jul 20, 2024 02:24:09.855067015 CEST	49829	8081	192.168.2.7	47.116.210.163
Jul 20, 2024 02:24:09.855067015 CEST	49829	8081	192.168.2.7	47.116.210.163
Jul 20, 2024 02:24:09.855391979 CEST	49894	5678	192.168.2.7	115.85.86.114
Jul 20, 2024 02:24:09.855880976 CEST	49895	4153	192.168.2.7	50.63.13.3
Jul 20, 2024 02:24:09.855962038 CEST	49896	5678	192.168.2.7	103.79.152.204
Jul 20, 2024 02:24:09.856192112 CEST	49897	4145	192.168.2.7	192.111.138.29
Jul 20, 2024 02:24:09.856334925 CEST	49898	5678	192.168.2.7	103.182.52.159
Jul 20, 2024 02:24:09.860210896 CEST	3128	49830	8.213.215.187	192.168.2.7
Jul 20, 2024 02:24:09.860379934 CEST	80	49893	104.24.69.32	192.168.2.7
Jul 20, 2024 02:24:09.860456944 CEST	49893	80	192.168.2.7	104.24.69.32
Jul 20, 2024 02:24:09.860651016 CEST	49893	80	192.168.2.7	104.24.69.32
Jul 20, 2024 02:24:09.860882044 CEST	8081	49829	47.116.210.163	192.168.2.7
Jul 20, 2024 02:24:09.861212969 CEST	5678	49894	115.85.86.114	192.168.2.7
Jul 20, 2024 02:24:09.861296892 CEST	49894	5678	192.168.2.7	115.85.86.114
Jul 20, 2024 02:24:09.861413956 CEST	4153	49895	50.63.13.3	192.168.2.7
Jul 20, 2024 02:24:09.861443996 CEST	5678	49896	103.79.152.204	192.168.2.7
Jul 20, 2024 02:24:09.861488104 CEST	3128	49830	8.213.215.187	192.168.2.7
Jul 20, 2024 02:24:09.861488104 CEST	49895	4153	192.168.2.7	50.63.13.3
Jul 20, 2024 02:24:09.861516953 CEST	4145	49897	192.111.138.29	192.168.2.7
Jul 20, 2024 02:24:09.861520052 CEST	49896	5678	192.168.2.7	103.79.152.204
Jul 20, 2024 02:24:09.861530066 CEST	49830	3128	192.168.2.7	8.213.215.187
Jul 20, 2024 02:24:09.861546993 CEST	5678	49898	103.182.52.159	192.168.2.7
Jul 20, 2024 02:24:09.861602068 CEST	49897	4145	192.168.2.7	192.111.138.29
Jul 20, 2024 02:24:09.861651897 CEST	49898	5678	192.168.2.7	103.182.52.159
Jul 20, 2024 02:24:09.861651897 CEST	49895	4153	192.168.2.7	50.63.13.3
Jul 20, 2024 02:24:09.861651897 CEST	49894	5678	192.168.2.7	115.85.86.114
Jul 20, 2024 02:24:09.861799955 CEST	49897	4145	192.168.2.7	192.111.138.29
Jul 20, 2024 02:24:09.861813068 CEST	49896	5678	192.168.2.7	103.79.152.204
Jul 20, 2024 02:24:09.861855030 CEST	49898	5678	192.168.2.7	103.182.52.159
Jul 20, 2024 02:24:09.865329981 CEST	8081	49829	47.116.210.163	192.168.2.7
Jul 20, 2024 02:24:09.865408897 CEST	49829	8081	192.168.2.7	47.116.210.163
Jul 20, 2024 02:24:09.866725922 CEST	80	49893	104.24.69.32	192.168.2.7
Jul 20, 2024 02:24:09.867542028 CEST	4153	49895	50.63.13.3	192.168.2.7
Jul 20, 2024 02:24:09.867737055 CEST	5678	49894	115.85.86.114	192.168.2.7
Jul 20, 2024 02:24:09.867764950 CEST	4145	49897	192.111.138.29	192.168.2.7
Jul 20, 2024 02:24:09.867791891 CEST	5678	49896	103.79.152.204	192.168.2.7
Jul 20, 2024 02:24:09.867819071 CEST	5678	49898	103.182.52.159	192.168.2.7
Jul 20, 2024 02:24:09.868948936 CEST	1661	49868	67.43.227.227	192.168.2.7
Jul 20, 2024 02:24:09.869010925 CEST	49868	1661	192.168.2.7	67.43.227.227
Jul 20, 2024 02:24:09.869115114 CEST	49868	1661	192.168.2.7	67.43.227.227
Jul 20, 2024 02:24:09.874777079 CEST	1661	49868	67.43.227.227	192.168.2.7
Jul 20, 2024 02:24:09.879466057 CEST	7403	49861	67.43.236.20	192.168.2.7
Jul 20, 2024 02:24:09.879535913 CEST	49861	7403	192.168.2.7	67.43.236.20
Jul 20, 2024 02:24:09.879688025 CEST	49861	7403	192.168.2.7	67.43.236.20
Jul 20, 2024 02:24:09.885562897 CEST	7403	49861	67.43.236.20	192.168.2.7
Jul 20, 2024 02:24:09.917124033 CEST	80	49834	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:09.917354107 CEST	49834	80	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:09.917354107 CEST	49834	80	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:09.922333956 CEST	80	49834	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:09.922741890 CEST	80	49834	47.238.128.246	192.168.2.7
Jul 20, 2024 02:24:09.922796011 CEST	49834	80	192.168.2.7	47.238.128.246
Jul 20, 2024 02:24:09.963857889 CEST	49899	58563	192.168.2.7	103.111.22.65
Jul 20, 2024 02:24:09.964262962 CEST	49900	4145	192.168.2.7	92.241.66.138
Jul 20, 2024 02:24:09.964438915 CEST	49901	110	192.168.2.7	78.146.180.112
Jul 20, 2024 02:24:09.968867064 CEST	58563	49899	103.111.22.65	192.168.2.7
Jul 20, 2024 02:24:09.968944073 CEST	49899	58563	192.168.2.7	103.111.22.65
Jul 20, 2024 02:24:09.969150066 CEST	4145	49900	92.241.66.138	192.168.2.7
Jul 20, 2024 02:24:09.969276905 CEST	49899	58563	192.168.2.7	103.111.22.65
Jul 20, 2024 02:24:09.969311953 CEST	49900	4145	192.168.2.7	92.241.66.138
Jul 20, 2024 02:24:09.969331980 CEST	110	49901	78.146.180.112	192.168.2.7
Jul 20, 2024 02:24:09.969408989 CEST	49900	4145	192.168.2.7	92.241.66.138
Jul 20, 2024 02:24:09.969430923 CEST	49901	110	192.168.2.7	78.146.180.112
Jul 20, 2024 02:24:09.969542027 CEST	49901	110	192.168.2.7	78.146.180.112
Jul 20, 2024 02:24:09.971626043 CEST	22179	49869	132.148.166.93	192.168.2.7
Jul 20, 2024 02:24:09.971688032 CEST	49869	22179	192.168.2.7	132.148.166.93
Jul 20, 2024 02:24:09.971801043 CEST	49869	22179	192.168.2.7	132.148.166.93
Jul 20, 2024 02:24:09.974220991 CEST	58563	49899	103.111.22.65	192.168.2.7
Jul 20, 2024 02:24:09.974278927 CEST	4145	49900	92.241.66.138	192.168.2.7
Jul 20, 2024 02:24:09.974495888 CEST	110	49901	78.146.180.112	192.168.2.7
Jul 20, 2024 02:24:09.978337049 CEST	22179	49869	132.148.166.93	192.168.2.7
Jul 20, 2024 02:24:10.005155087 CEST	14289	49871	207.244.255.174	192.168.2.7
Jul 20, 2024 02:24:10.005373001 CEST	49871	14289	192.168.2.7	207.244.255.174
Jul 20, 2024 02:24:10.005373955 CEST	49871	14289	192.168.2.7	207.244.255.174
Jul 20, 2024 02:24:10.010234118 CEST	14289	49871	207.244.255.174	192.168.2.7
Jul 20, 2024 02:24:10.073174000 CEST	49902	15303	192.168.2.7	184.178.172.5
Jul 20, 2024 02:24:10.073297024 CEST	49903	50539	192.168.2.7	109.238.12.156
Jul 20, 2024 02:24:10.078461885 CEST	15303	49902	184.178.172.5	192.168.2.7
Jul 20, 2024 02:24:10.078550100 CEST	49902	15303	192.168.2.7	184.178.172.5
Jul 20, 2024 02:24:10.078720093 CEST	49902	15303	192.168.2.7	184.178.172.5
Jul 20, 2024 02:24:10.080358982 CEST	50539	49903	109.238.12.156	192.168.2.7
Jul 20, 2024 02:24:10.080408096 CEST	49903	50539	192.168.2.7	109.238.12.156
Jul 20, 2024 02:24:10.080519915 CEST	49903	50539	192.168.2.7	109.238.12.156
Jul 20, 2024 02:24:10.084094048 CEST	15303	49902	184.178.172.5	192.168.2.7
Jul 20, 2024 02:24:10.086340904 CEST	50539	49903	109.238.12.156	192.168.2.7
Jul 20, 2024 02:24:10.157967091 CEST	4145	49887	104.37.135.145	192.168.2.7
Jul 20, 2024 02:24:10.158083916 CEST	49887	4145	192.168.2.7	104.37.135.145
Jul 20, 2024 02:24:10.158162117 CEST	49887	4145	192.168.2.7	104.37.135.145
Jul 20, 2024 02:24:10.162931919 CEST	4145	49887	104.37.135.145	192.168.2.7
Jul 20, 2024 02:24:10.163428068 CEST	4145	49887	104.37.135.145	192.168.2.7
Jul 20, 2024 02:24:10.163475037 CEST	49887	4145	192.168.2.7	104.37.135.145
Jul 20, 2024 02:24:10.182513952 CEST	49904	9170	192.168.2.7	173.212.237.43
Jul 20, 2024 02:24:10.182641983 CEST	49905	33475	192.168.2.7	178.62.7.98
Jul 20, 2024 02:24:10.193739891 CEST	9170	49904	173.212.237.43	192.168.2.7
Jul 20, 2024 02:24:10.193782091 CEST	33475	49905	178.62.7.98	192.168.2.7
Jul 20, 2024 02:24:10.193826914 CEST	49904	9170	192.168.2.7	173.212.237.43
Jul 20, 2024 02:24:10.193865061 CEST	49905	33475	192.168.2.7	178.62.7.98
Jul 20, 2024 02:24:10.194000959 CEST	49904	9170	192.168.2.7	173.212.237.43
Jul 20, 2024 02:24:10.194040060 CEST	49905	33475	192.168.2.7	178.62.7.98
Jul 20, 2024 02:24:10.198934078 CEST	9170	49904	173.212.237.43	192.168.2.7
Jul 20, 2024 02:24:10.199480057 CEST	33475	49905	178.62.7.98	192.168.2.7
Jul 20, 2024 02:24:10.215660095 CEST	14287	49888	192.252.208.67	192.168.2.7
Jul 20, 2024 02:24:10.215738058 CEST	49888	14287	192.168.2.7	192.252.208.67
Jul 20, 2024 02:24:10.216178894 CEST	49888	14287	192.168.2.7	192.252.208.67
Jul 20, 2024 02:24:10.221028090 CEST	14287	49888	192.252.208.67	192.168.2.7
Jul 20, 2024 02:24:10.225074053 CEST	14287	49888	192.252.208.67	192.168.2.7
Jul 20, 2024 02:24:10.225156069 CEST	49888	14287	192.168.2.7	192.252.208.67
Jul 20, 2024 02:24:10.228692055 CEST	3128	49850	47.90.149.238	192.168.2.7
Jul 20, 2024 02:24:10.229048967 CEST	49850	3128	192.168.2.7	47.90.149.238
Jul 20, 2024 02:24:10.229048967 CEST	49850	3128	192.168.2.7	47.90.149.238
Jul 20, 2024 02:24:10.233911991 CEST	3128	49850	47.90.149.238	192.168.2.7
Jul 20, 2024 02:24:10.239099026 CEST	3128	49850	47.90.149.238	192.168.2.7
Jul 20, 2024 02:24:10.239160061 CEST	49850	3128	192.168.2.7	47.90.149.238
Jul 20, 2024 02:24:10.291984081 CEST	49906	4153	192.168.2.7	182.253.246.213
Jul 20, 2024 02:24:10.292006016 CEST	49907	63123	192.168.2.7	103.135.7.2
Jul 20, 2024 02:24:10.296786070 CEST	4153	49906	182.253.246.213	192.168.2.7
Jul 20, 2024 02:24:10.296840906 CEST	63123	49907	103.135.7.2	192.168.2.7
Jul 20, 2024 02:24:10.296865940 CEST	49906	4153	192.168.2.7	182.253.246.213
Jul 20, 2024 02:24:10.296892881 CEST	49907	63123	192.168.2.7	103.135.7.2
Jul 20, 2024 02:24:10.297116995 CEST	49906	4153	192.168.2.7	182.253.246.213
Jul 20, 2024 02:24:10.297142029 CEST	49907	63123	192.168.2.7	103.135.7.2
Jul 20, 2024 02:24:10.301876068 CEST	4153	49906	182.253.246.213	192.168.2.7
Jul 20, 2024 02:24:10.302256107 CEST	63123	49907	103.135.7.2	192.168.2.7
Jul 20, 2024 02:24:10.306417942 CEST	80	49893	104.24.69.32	192.168.2.7
Jul 20, 2024 02:24:10.306552887 CEST	49893	80	192.168.2.7	104.24.69.32
Jul 20, 2024 02:24:10.307435989 CEST	80	49893	104.24.69.32	192.168.2.7
Jul 20, 2024 02:24:10.307578087 CEST	49893	80	192.168.2.7	104.24.69.32
Jul 20, 2024 02:24:10.458779097 CEST	8080	49875	95.216.194.176	192.168.2.7
Jul 20, 2024 02:24:10.458836079 CEST	49875	8080	192.168.2.7	95.216.194.176
Jul 20, 2024 02:24:10.458988905 CEST	49875	8080	192.168.2.7	95.216.194.176
Jul 20, 2024 02:24:10.463922024 CEST	8080	49875	95.216.194.176	192.168.2.7
Jul 20, 2024 02:24:10.510855913 CEST	49908	42021	192.168.2.7	162.241.45.22
Jul 20, 2024 02:24:10.510998011 CEST	49909	4145	192.168.2.7	110.139.128.232
Jul 20, 2024 02:24:10.516104937 CEST	42021	49908	162.241.45.22	192.168.2.7
Jul 20, 2024 02:24:10.516154051 CEST	4145	49909	110.139.128.232	192.168.2.7
Jul 20, 2024 02:24:10.516171932 CEST	49908	42021	192.168.2.7	162.241.45.22
Jul 20, 2024 02:24:10.516192913 CEST	49909	4145	192.168.2.7	110.139.128.232
Jul 20, 2024 02:24:10.516383886 CEST	49908	42021	192.168.2.7	162.241.45.22
Jul 20, 2024 02:24:10.516515017 CEST	49909	4145	192.168.2.7	110.139.128.232
Jul 20, 2024 02:24:10.522229910 CEST	42021	49908	162.241.45.22	192.168.2.7
Jul 20, 2024 02:24:10.522243023 CEST	4145	49909	110.139.128.232	192.168.2.7
Jul 20, 2024 02:24:10.665401936 CEST	15303	49902	184.178.172.5	192.168.2.7
Jul 20, 2024 02:24:10.665488958 CEST	49902	15303	192.168.2.7	184.178.172.5
Jul 20, 2024 02:24:10.665587902 CEST	49902	15303	192.168.2.7	184.178.172.5
Jul 20, 2024 02:24:10.670756102 CEST	15303	49902	184.178.172.5	192.168.2.7
Jul 20, 2024 02:24:10.671606064 CEST	15303	49902	184.178.172.5	192.168.2.7
Jul 20, 2024 02:24:10.671652079 CEST	49902	15303	192.168.2.7	184.178.172.5
Jul 20, 2024 02:24:10.688123941 CEST	43581	49877	162.214.154.141	192.168.2.7
Jul 20, 2024 02:24:10.688188076 CEST	49877	43581	192.168.2.7	162.214.154.141
Jul 20, 2024 02:24:10.688282967 CEST	49877	43581	192.168.2.7	162.214.154.141
Jul 20, 2024 02:24:10.693470001 CEST	43581	49877	162.214.154.141	192.168.2.7
Jul 20, 2024 02:24:10.729527950 CEST	49910	80	192.168.2.7	103.152.112.234
Jul 20, 2024 02:24:10.729696989 CEST	49911	38188	192.168.2.7	185.18.198.163
Jul 20, 2024 02:24:10.734889984 CEST	80	49910	103.152.112.234	192.168.2.7
Jul 20, 2024 02:24:10.734914064 CEST	38188	49911	185.18.198.163	192.168.2.7
Jul 20, 2024 02:24:10.735073090 CEST	49910	80	192.168.2.7	103.152.112.234
Jul 20, 2024 02:24:10.735073090 CEST	49911	38188	192.168.2.7	185.18.198.163
Jul 20, 2024 02:24:10.735198975 CEST	49910	80	192.168.2.7	103.152.112.234
Jul 20, 2024 02:24:10.735236883 CEST	49911	38188	192.168.2.7	185.18.198.163
Jul 20, 2024 02:24:10.740061998 CEST	80	49910	103.152.112.234	192.168.2.7
Jul 20, 2024 02:24:10.740144968 CEST	38188	49911	185.18.198.163	192.168.2.7
Jul 20, 2024 02:24:10.743582010 CEST	13697	49883	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:10.743721008 CEST	49883	13697	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:10.743813038 CEST	49883	13697	192.168.2.7	72.10.160.172
Jul 20, 2024 02:24:10.749103069 CEST	13697	49883	72.10.160.172	192.168.2.7
Jul 20, 2024 02:24:10.975538969 CEST	45764	49885	162.214.162.156	192.168.2.7
Jul 20, 2024 02:24:10.975641012 CEST	49885	45764	192.168.2.7	162.214.162.156
Jul 20, 2024 02:24:10.975749016 CEST	49885	45764	192.168.2.7	162.214.162.156
Jul 20, 2024 02:24:10.980837107 CEST	45764	49885	162.214.162.156	192.168.2.7
Jul 20, 2024 02:24:11.069164991 CEST	49912	5678	192.168.2.7	185.78.16.76
Jul 20, 2024 02:24:11.074182034 CEST	5678	49912	185.78.16.76	192.168.2.7
Jul 20, 2024 02:24:11.074254036 CEST	49912	5678	192.168.2.7	185.78.16.76
Jul 20, 2024 02:24:11.074496031 CEST	49912	5678	192.168.2.7	185.78.16.76
Jul 20, 2024 02:24:11.082511902 CEST	5678	49912	185.78.16.76	192.168.2.7
Jul 20, 2024 02:24:11.674669981 CEST	4153	49895	50.63.13.3	192.168.2.7
Jul 20, 2024 02:24:11.674765110 CEST	49895	4153	192.168.2.7	50.63.13.3
Jul 20, 2024 02:24:11.674920082 CEST	49895	4153	192.168.2.7	50.63.13.3
Jul 20, 2024 02:24:11.676389933 CEST	4153	49895	50.63.13.3	192.168.2.7
Jul 20, 2024 02:24:11.678808928 CEST	49895	4153	192.168.2.7	50.63.13.3
Jul 20, 2024 02:24:11.679960966 CEST	4153	49895	50.63.13.3	192.168.2.7
Jul 20, 2024 02:24:11.722258091 CEST	50539	49903	109.238.12.156	192.168.2.7
Jul 20, 2024 02:24:11.722337008 CEST	49903	50539	192.168.2.7	109.238.12.156
Jul 20, 2024 02:24:11.722455025 CEST	49903	50539	192.168.2.7	109.238.12.156
Jul 20, 2024 02:24:11.728719950 CEST	50539	49903	109.238.12.156	192.168.2.7
Jul 20, 2024 02:24:11.729475021 CEST	49913	4145	192.168.2.7	199.102.104.70
Jul 20, 2024 02:24:11.729635954 CEST	49914	4145	192.168.2.7	184.178.172.11
Jul 20, 2024 02:24:11.734419107 CEST	4145	49913	199.102.104.70	192.168.2.7
Jul 20, 2024 02:24:11.734492064 CEST	49913	4145	192.168.2.7	199.102.104.70
Jul 20, 2024 02:24:11.734683990 CEST	49913	4145	192.168.2.7	199.102.104.70
Jul 20, 2024 02:24:11.734700918 CEST	4145	49914	184.178.172.11	192.168.2.7
Jul 20, 2024 02:24:11.734756947 CEST	49914	4145	192.168.2.7	184.178.172.11
Jul 20, 2024 02:24:11.734946966 CEST	49914	4145	192.168.2.7	184.178.172.11
Jul 20, 2024 02:24:11.739731073 CEST	4145	49913	199.102.104.70	192.168.2.7
Jul 20, 2024 02:24:11.739834070 CEST	4145	49914	184.178.172.11	192.168.2.7
Jul 20, 2024 02:24:11.856137037 CEST	9170	49904	173.212.237.43	192.168.2.7
Jul 20, 2024 02:24:11.859232903 CEST	49904	9170	192.168.2.7	173.212.237.43
Jul 20, 2024 02:24:11.859353065 CEST	49904	9170	192.168.2.7	173.212.237.43
Jul 20, 2024 02:24:11.864461899 CEST	9170	49904	173.212.237.43	192.168.2.7
Jul 20, 2024 02:24:11.948237896 CEST	49915	1080	192.168.2.7	200.85.169.221
Jul 20, 2024 02:24:11.953442097 CEST	1080	49915	200.85.169.221	192.168.2.7
Jul 20, 2024 02:24:11.955235958 CEST	49915	1080	192.168.2.7	200.85.169.221
Jul 20, 2024 02:24:11.955399990 CEST	49915	1080	192.168.2.7	200.85.169.221
Jul 20, 2024 02:24:11.960465908 CEST	1080	49915	200.85.169.221	192.168.2.7
Jul 20, 2024 02:24:12.156253099 CEST	5566	49771	162.55.87.48	192.168.2.7
Jul 20, 2024 02:24:12.159229994 CEST	49771	5566	192.168.2.7	162.55.87.48
Jul 20, 2024 02:24:12.159396887 CEST	49771	5566	192.168.2.7	162.55.87.48
Jul 20, 2024 02:24:12.164314985 CEST	5566	49771	162.55.87.48	192.168.2.7
Jul 20, 2024 02:24:12.166862011 CEST	49916	45644	192.168.2.7	97.74.229.3
Jul 20, 2024 02:24:12.172141075 CEST	45644	49916	97.74.229.3	192.168.2.7
Jul 20, 2024 02:24:12.172887087 CEST	49916	45644	192.168.2.7	97.74.229.3
Jul 20, 2024 02:24:12.173070908 CEST	49916	45644	192.168.2.7	97.74.229.3
Jul 20, 2024 02:24:12.178306103 CEST	45644	49916	97.74.229.3	192.168.2.7
Jul 20, 2024 02:24:12.322129965 CEST	4145	49914	184.178.172.11	192.168.2.7
Jul 20, 2024 02:24:12.322274923 CEST	49914	4145	192.168.2.7	184.178.172.11
Jul 20, 2024 02:24:12.322276115 CEST	49914	4145	192.168.2.7	184.178.172.11
Jul 20, 2024 02:24:12.327646971 CEST	4145	49914	184.178.172.11	192.168.2.7
Jul 20, 2024 02:24:12.328105927 CEST	4145	49914	184.178.172.11	192.168.2.7
Jul 20, 2024 02:24:12.328161955 CEST	49914	4145	192.168.2.7	184.178.172.11
Jul 20, 2024 02:24:12.378540039 CEST	4145	49913	199.102.104.70	192.168.2.7
Jul 20, 2024 02:24:12.378637075 CEST	49913	4145	192.168.2.7	199.102.104.70
Jul 20, 2024 02:24:12.378710032 CEST	49913	4145	192.168.2.7	199.102.104.70
Jul 20, 2024 02:24:12.383924961 CEST	4145	49913	199.102.104.70	192.168.2.7
Jul 20, 2024 02:24:12.384251118 CEST	4145	49913	199.102.104.70	192.168.2.7
Jul 20, 2024 02:24:12.384299994 CEST	49913	4145	192.168.2.7	199.102.104.70
Jul 20, 2024 02:24:12.385620117 CEST	49917	1080	192.168.2.7	103.47.93.236
Jul 20, 2024 02:24:12.385786057 CEST	49918	9080	192.168.2.7	8.213.156.191
Jul 20, 2024 02:24:12.390723944 CEST	1080	49917	103.47.93.236	192.168.2.7
Jul 20, 2024 02:24:12.390811920 CEST	49917	1080	192.168.2.7	103.47.93.236
Jul 20, 2024 02:24:12.391033888 CEST	49917	1080	192.168.2.7	103.47.93.236
Jul 20, 2024 02:24:12.393642902 CEST	9080	49918	8.213.156.191	192.168.2.7
Jul 20, 2024 02:24:12.393723965 CEST	49918	9080	192.168.2.7	8.213.156.191
Jul 20, 2024 02:24:12.393851042 CEST	49918	9080	192.168.2.7	8.213.156.191
Jul 20, 2024 02:24:12.395919085 CEST	1080	49917	103.47.93.236	192.168.2.7
Jul 20, 2024 02:24:12.398724079 CEST	9080	49918	8.213.156.191	192.168.2.7
Jul 20, 2024 02:24:12.419787884 CEST	38188	49911	185.18.198.163	192.168.2.7
Jul 20, 2024 02:24:12.420028925 CEST	49911	38188	192.168.2.7	185.18.198.163
Jul 20, 2024 02:24:12.420197010 CEST	49911	38188	192.168.2.7	185.18.198.163
Jul 20, 2024 02:24:12.425154924 CEST	38188	49911	185.18.198.163	192.168.2.7
Jul 20, 2024 02:24:12.430318117 CEST	63123	49907	103.135.7.2	192.168.2.7
Jul 20, 2024 02:24:12.430409908 CEST	49907	63123	192.168.2.7	103.135.7.2
Jul 20, 2024 02:24:12.430583000 CEST	49907	63123	192.168.2.7	103.135.7.2
Jul 20, 2024 02:24:12.435640097 CEST	63123	49907	103.135.7.2	192.168.2.7
Jul 20, 2024 02:24:12.496901035 CEST	49919	5678	192.168.2.7	103.141.189.62
Jul 20, 2024 02:24:12.497208118 CEST	49920	4153	192.168.2.7	45.251.57.49
Jul 20, 2024 02:24:12.501976967 CEST	5678	49919	103.141.189.62	192.168.2.7
Jul 20, 2024 02:24:12.502096891 CEST	49919	5678	192.168.2.7	103.141.189.62
Jul 20, 2024 02:24:12.502219915 CEST	4153	49920	45.251.57.49	192.168.2.7
Jul 20, 2024 02:24:12.502242088 CEST	49919	5678	192.168.2.7	103.141.189.62
Jul 20, 2024 02:24:12.502285957 CEST	49920	4153	192.168.2.7	45.251.57.49
Jul 20, 2024 02:24:12.502386093 CEST	49920	4153	192.168.2.7	45.251.57.49
Jul 20, 2024 02:24:12.507376909 CEST	5678	49919	103.141.189.62	192.168.2.7
Jul 20, 2024 02:24:12.507406950 CEST	4153	49920	45.251.57.49	192.168.2.7
Jul 20, 2024 02:24:12.566265106 CEST	18765	49755	192.111.137.34	192.168.2.7
Jul 20, 2024 02:24:12.566487074 CEST	49755	18765	192.168.2.7	192.111.137.34
Jul 20, 2024 02:24:12.566545963 CEST	49755	18765	192.168.2.7	192.111.137.34
Jul 20, 2024 02:24:12.571990967 CEST	18765	49755	192.111.137.34	192.168.2.7
Jul 20, 2024 02:24:12.572715044 CEST	18765	49755	192.111.137.34	192.168.2.7
Jul 20, 2024 02:24:12.572781086 CEST	49755	18765	192.168.2.7	192.111.137.34
Jul 20, 2024 02:24:12.604453087 CEST	49921	4153	192.168.2.7	81.12.169.254
Jul 20, 2024 02:24:12.604542971 CEST	49922	11531	192.168.2.7	195.2.76.207
Jul 20, 2024 02:24:12.609443903 CEST	4153	49921	81.12.169.254	192.168.2.7
Jul 20, 2024 02:24:12.609527111 CEST	49921	4153	192.168.2.7	81.12.169.254
Jul 20, 2024 02:24:12.609574080 CEST	11531	49922	195.2.76.207	192.168.2.7
Jul 20, 2024 02:24:12.609632969 CEST	49922	11531	192.168.2.7	195.2.76.207
Jul 20, 2024 02:24:12.609760046 CEST	49921	4153	192.168.2.7	81.12.169.254
Jul 20, 2024 02:24:12.609772921 CEST	49922	11531	192.168.2.7	195.2.76.207
Jul 20, 2024 02:24:12.614620924 CEST	4153	49921	81.12.169.254	192.168.2.7
Jul 20, 2024 02:24:12.614979029 CEST	11531	49922	195.2.76.207	192.168.2.7
Jul 20, 2024 02:24:12.646213055 CEST	4145	49909	110.139.128.232	192.168.2.7
Jul 20, 2024 02:24:12.646313906 CEST	49909	4145	192.168.2.7	110.139.128.232
Jul 20, 2024 02:24:12.646434069 CEST	49909	4145	192.168.2.7	110.139.128.232
Jul 20, 2024 02:24:12.651360989 CEST	4145	49909	110.139.128.232	192.168.2.7
Jul 20, 2024 02:24:13.743082047 CEST	45644	49916	97.74.229.3	192.168.2.7
Jul 20, 2024 02:24:13.743247986 CEST	49916	45644	192.168.2.7	97.74.229.3
Jul 20, 2024 02:24:13.743448973 CEST	49916	45644	192.168.2.7	97.74.229.3
Jul 20, 2024 02:24:13.748650074 CEST	45644	49916	97.74.229.3	192.168.2.7
Jul 20, 2024 02:24:13.807895899 CEST	49923	4153	192.168.2.7	185.32.47.105
Jul 20, 2024 02:24:13.813067913 CEST	4153	49923	185.32.47.105	192.168.2.7
Jul 20, 2024 02:24:13.813188076 CEST	49923	4153	192.168.2.7	185.32.47.105
Jul 20, 2024 02:24:13.813457012 CEST	49923	4153	192.168.2.7	185.32.47.105
Jul 20, 2024 02:24:13.818587065 CEST	4153	49923	185.32.47.105	192.168.2.7
Jul 20, 2024 02:24:13.949265003 CEST	4145	49822	192.111.137.35	192.168.2.7
Jul 20, 2024 02:24:13.949377060 CEST	49822	4145	192.168.2.7	192.111.137.35
Jul 20, 2024 02:24:13.949438095 CEST	49822	4145	192.168.2.7	192.111.137.35
Jul 20, 2024 02:24:13.954370975 CEST	4145	49822	192.111.137.35	192.168.2.7
Jul 20, 2024 02:24:13.954948902 CEST	4145	49822	192.111.137.35	192.168.2.7
Jul 20, 2024 02:24:13.955001116 CEST	49822	4145	192.168.2.7	192.111.137.35
Jul 20, 2024 02:24:14.026313066 CEST	49925	14827	192.168.2.7	166.62.88.163
Jul 20, 2024 02:24:14.026357889 CEST	49924	5678	192.168.2.7	141.105.107.152
Jul 20, 2024 02:24:14.031363964 CEST	14827	49925	166.62.88.163	192.168.2.7
Jul 20, 2024 02:24:14.031433105 CEST	5678	49924	141.105.107.152	192.168.2.7
Jul 20, 2024 02:24:14.031452894 CEST	49925	14827	192.168.2.7	166.62.88.163
Jul 20, 2024 02:24:14.031483889 CEST	49924	5678	192.168.2.7	141.105.107.152
Jul 20, 2024 02:24:14.031621933 CEST	49925	14827	192.168.2.7	166.62.88.163
Jul 20, 2024 02:24:14.031639099 CEST	49924	5678	192.168.2.7	141.105.107.152
Jul 20, 2024 02:24:14.036621094 CEST	14827	49925	166.62.88.163	192.168.2.7
Jul 20, 2024 02:24:14.036652088 CEST	5678	49924	141.105.107.152	192.168.2.7
Jul 20, 2024 02:24:14.363976955 CEST	11531	49922	195.2.76.207	192.168.2.7
Jul 20, 2024 02:24:14.364131927 CEST	49922	11531	192.168.2.7	195.2.76.207
Jul 20, 2024 02:24:14.364262104 CEST	49922	11531	192.168.2.7	195.2.76.207
Jul 20, 2024 02:24:14.370805025 CEST	11531	49922	195.2.76.207	192.168.2.7
Jul 20, 2024 02:24:14.855556965 CEST	5678	49912	185.78.16.76	192.168.2.7
Jul 20, 2024 02:24:14.855741978 CEST	49912	5678	192.168.2.7	185.78.16.76
Jul 20, 2024 02:24:14.855742931 CEST	49912	5678	192.168.2.7	185.78.16.76
Jul 20, 2024 02:24:14.860825062 CEST	5678	49912	185.78.16.76	192.168.2.7
Jul 20, 2024 02:24:14.861501932 CEST	5678	49912	185.78.16.76	192.168.2.7
Jul 20, 2024 02:24:14.861567974 CEST	49912	5678	192.168.2.7	185.78.16.76
Jul 20, 2024 02:24:14.901262045 CEST	49926	4145	192.168.2.7	103.121.214.50
Jul 20, 2024 02:24:14.906300068 CEST	4145	49926	103.121.214.50	192.168.2.7
Jul 20, 2024 02:24:14.906371117 CEST	49926	4145	192.168.2.7	103.121.214.50
Jul 20, 2024 02:24:14.906547070 CEST	49926	4145	192.168.2.7	103.121.214.50
Jul 20, 2024 02:24:14.912096024 CEST	4145	49926	103.121.214.50	192.168.2.7
Jul 20, 2024 02:24:15.003730059 CEST	36835	49719	188.173.14.99	192.168.2.7
Jul 20, 2024 02:24:15.003950119 CEST	49719	36835	192.168.2.7	188.173.14.99
Jul 20, 2024 02:24:15.004105091 CEST	49719	36835	192.168.2.7	188.173.14.99
Jul 20, 2024 02:24:15.008932114 CEST	36835	49719	188.173.14.99	192.168.2.7
Jul 20, 2024 02:24:15.010886908 CEST	49927	7749	192.168.2.7	148.72.210.123
Jul 20, 2024 02:24:15.010917902 CEST	49928	39820	192.168.2.7	198.12.253.239
Jul 20, 2024 02:24:15.015783072 CEST	7749	49927	148.72.210.123	192.168.2.7
Jul 20, 2024 02:24:15.015877962 CEST	49927	7749	192.168.2.7	148.72.210.123
Jul 20, 2024 02:24:15.015948057 CEST	39820	49928	198.12.253.239	192.168.2.7
Jul 20, 2024 02:24:15.016004086 CEST	49928	39820	192.168.2.7	198.12.253.239
Jul 20, 2024 02:24:15.016124010 CEST	49927	7749	192.168.2.7	148.72.210.123
Jul 20, 2024 02:24:15.016144037 CEST	49928	39820	192.168.2.7	198.12.253.239
Jul 20, 2024 02:24:15.021076918 CEST	7749	49927	148.72.210.123	192.168.2.7
Jul 20, 2024 02:24:15.021094084 CEST	39820	49928	198.12.253.239	192.168.2.7
Jul 20, 2024 02:24:15.074415922 CEST	1080	49707	109.120.222.90	192.168.2.7
Jul 20, 2024 02:24:15.074657917 CEST	49707	1080	192.168.2.7	109.120.222.90
Jul 20, 2024 02:24:15.074752092 CEST	49707	1080	192.168.2.7	109.120.222.90
Jul 20, 2024 02:24:15.079540968 CEST	1080	49707	109.120.222.90	192.168.2.7
Jul 20, 2024 02:24:15.080024004 CEST	1080	49707	109.120.222.90	192.168.2.7
Jul 20, 2024 02:24:15.080110073 CEST	49707	1080	192.168.2.7	109.120.222.90
Jul 20, 2024 02:24:15.088035107 CEST	5678	49716	46.231.72.35	192.168.2.7
Jul 20, 2024 02:24:15.088212967 CEST	49716	5678	192.168.2.7	46.231.72.35
Jul 20, 2024 02:24:15.088212967 CEST	49716	5678	192.168.2.7	46.231.72.35
Jul 20, 2024 02:24:15.093154907 CEST	5678	49716	46.231.72.35	192.168.2.7
Jul 20, 2024 02:24:15.093492985 CEST	5678	49716	46.231.72.35	192.168.2.7
Jul 20, 2024 02:24:15.093554020 CEST	49716	5678	192.168.2.7	46.231.72.35
Jul 20, 2024 02:24:15.120121002 CEST	49929	19212	192.168.2.7	135.148.10.161
Jul 20, 2024 02:24:15.120151043 CEST	49930	24949	192.168.2.7	162.214.75.237
Jul 20, 2024 02:24:15.125101089 CEST	19212	49929	135.148.10.161	192.168.2.7
Jul 20, 2024 02:24:15.125173092 CEST	24949	49930	162.214.75.237	192.168.2.7
Jul 20, 2024 02:24:15.125195980 CEST	49929	19212	192.168.2.7	135.148.10.161
Jul 20, 2024 02:24:15.125236988 CEST	49930	24949	192.168.2.7	162.214.75.237
Jul 20, 2024 02:24:15.125382900 CEST	49929	19212	192.168.2.7	135.148.10.161
Jul 20, 2024 02:24:15.125406981 CEST	49930	24949	192.168.2.7	162.214.75.237
Jul 20, 2024 02:24:15.130242109 CEST	19212	49929	135.148.10.161	192.168.2.7
Jul 20, 2024 02:24:15.130712986 CEST	24949	49930	162.214.75.237	192.168.2.7
Jul 20, 2024 02:24:15.235910892 CEST	9080	49918	8.213.156.191	192.168.2.7
Jul 20, 2024 02:24:15.236090899 CEST	49918	9080	192.168.2.7	8.213.156.191
Jul 20, 2024 02:24:15.236155033 CEST	49918	9080	192.168.2.7	8.213.156.191
Jul 20, 2024 02:24:15.243237972 CEST	9080	49918	8.213.156.191	192.168.2.7
Jul 20, 2024 02:24:15.243267059 CEST	9080	49918	8.213.156.191	192.168.2.7
Jul 20, 2024 02:24:15.243407965 CEST	49918	9080	192.168.2.7	8.213.156.191
Jul 20, 2024 02:24:15.599380970 CEST	14827	49925	166.62.88.163	192.168.2.7
Jul 20, 2024 02:24:15.599494934 CEST	49925	14827	192.168.2.7	166.62.88.163
Jul 20, 2024 02:24:15.599664927 CEST	49925	14827	192.168.2.7	166.62.88.163
Jul 20, 2024 02:24:15.604599953 CEST	14827	49925	166.62.88.163	192.168.2.7
Jul 20, 2024 02:24:15.667252064 CEST	49931	15473	192.168.2.7	45.124.84.110
Jul 20, 2024 02:24:15.667460918 CEST	49932	31991	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:15.672585964 CEST	15473	49931	45.124.84.110	192.168.2.7
Jul 20, 2024 02:24:15.672627926 CEST	31991	49932	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:15.672754049 CEST	49932	31991	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:15.672771931 CEST	49931	15473	192.168.2.7	45.124.84.110
Jul 20, 2024 02:24:15.672979116 CEST	49931	15473	192.168.2.7	45.124.84.110
Jul 20, 2024 02:24:15.673693895 CEST	49932	31991	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:15.677862883 CEST	15473	49931	45.124.84.110	192.168.2.7
Jul 20, 2024 02:24:15.678677082 CEST	31991	49932	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:16.342462063 CEST	4153	49921	81.12.169.254	192.168.2.7
Jul 20, 2024 02:24:16.342551947 CEST	49921	4153	192.168.2.7	81.12.169.254
Jul 20, 2024 02:24:16.342634916 CEST	49921	4153	192.168.2.7	81.12.169.254
Jul 20, 2024 02:24:16.347528934 CEST	4153	49921	81.12.169.254	192.168.2.7
Jul 20, 2024 02:24:16.347855091 CEST	4153	49921	81.12.169.254	192.168.2.7
Jul 20, 2024 02:24:16.347904921 CEST	49921	4153	192.168.2.7	81.12.169.254
Jul 20, 2024 02:24:16.361947060 CEST	31991	49932	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:16.362040997 CEST	49932	31991	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:16.362226009 CEST	49932	31991	192.168.2.7	94.131.7.1
Jul 20, 2024 02:24:16.367309093 CEST	31991	49932	94.131.7.1	192.168.2.7
Jul 20, 2024 02:24:16.432440996 CEST	49934	80	192.168.2.7	119.59.101.111
Jul 20, 2024 02:24:16.437388897 CEST	80	49934	119.59.101.111	192.168.2.7
Jul 20, 2024 02:24:16.437472105 CEST	49934	80	192.168.2.7	119.59.101.111
Jul 20, 2024 02:24:16.437880993 CEST	49934	80	192.168.2.7	119.59.101.111
Jul 20, 2024 02:24:16.443876028 CEST	80	49934	119.59.101.111	192.168.2.7
Jul 20, 2024 02:24:16.473676920 CEST	5678	49919	103.141.189.62	192.168.2.7
Jul 20, 2024 02:24:16.473763943 CEST	49919	5678	192.168.2.7	103.141.189.62
Jul 20, 2024 02:24:16.473850965 CEST	49919	5678	192.168.2.7	103.141.189.62
Jul 20, 2024 02:24:16.478755951 CEST	5678	49919	103.141.189.62	192.168.2.7
Jul 20, 2024 02:24:16.479554892 CEST	5678	49919	103.141.189.62	192.168.2.7
Jul 20, 2024 02:24:16.479604006 CEST	49919	5678	192.168.2.7	103.141.189.62
Jul 20, 2024 02:24:16.532282114 CEST	19212	49929	135.148.10.161	192.168.2.7
Jul 20, 2024 02:24:16.532402992 CEST	49929	19212	192.168.2.7	135.148.10.161
Jul 20, 2024 02:24:16.532563925 CEST	49929	19212	192.168.2.7	135.148.10.161
Jul 20, 2024 02:24:16.537396908 CEST	19212	49929	135.148.10.161	192.168.2.7
Jul 20, 2024 02:24:16.541996956 CEST	49935	46394	192.168.2.7	92.205.110.118
Jul 20, 2024 02:24:16.542299032 CEST	49936	15397	192.168.2.7	45.89.19.85
Jul 20, 2024 02:24:16.547027111 CEST	46394	49935	92.205.110.118	192.168.2.7
Jul 20, 2024 02:24:16.547161102 CEST	49935	46394	192.168.2.7	92.205.110.118
Jul 20, 2024 02:24:16.547180891 CEST	15397	49936	45.89.19.85	192.168.2.7
Jul 20, 2024 02:24:16.547274113 CEST	49936	15397	192.168.2.7	45.89.19.85
Jul 20, 2024 02:24:16.547399998 CEST	49935	46394	192.168.2.7	92.205.110.118
Jul 20, 2024 02:24:16.547542095 CEST	49936	15397	192.168.2.7	45.89.19.85
Jul 20, 2024 02:24:16.552232027 CEST	46394	49935	92.205.110.118	192.168.2.7
Jul 20, 2024 02:24:16.552428007 CEST	15397	49936	45.89.19.85	192.168.2.7
Jul 20, 2024 02:24:16.567096949 CEST	39820	49928	198.12.253.239	192.168.2.7
Jul 20, 2024 02:24:16.567220926 CEST	49928	39820	192.168.2.7	198.12.253.239
Jul 20, 2024 02:24:16.567404032 CEST	49928	39820	192.168.2.7	198.12.253.239
Jul 20, 2024 02:24:16.572309017 CEST	39820	49928	198.12.253.239	192.168.2.7
Jul 20, 2024 02:24:16.651514053 CEST	49937	5678	192.168.2.7	181.28.137.18
Jul 20, 2024 02:24:16.651671886 CEST	49938	8088	192.168.2.7	5.188.66.181
Jul 20, 2024 02:24:16.657407999 CEST	5678	49937	181.28.137.18	192.168.2.7
Jul 20, 2024 02:24:16.657445908 CEST	8088	49938	5.188.66.181	192.168.2.7
Jul 20, 2024 02:24:16.657655954 CEST	49937	5678	192.168.2.7	181.28.137.18
Jul 20, 2024 02:24:16.657748938 CEST	49938	8088	192.168.2.7	5.188.66.181
Jul 20, 2024 02:24:16.658027887 CEST	49937	5678	192.168.2.7	181.28.137.18
Jul 20, 2024 02:24:16.658085108 CEST	49938	8088	192.168.2.7	5.188.66.181
Jul 20, 2024 02:24:16.663844109 CEST	5678	49937	181.28.137.18	192.168.2.7
Jul 20, 2024 02:24:16.663928986 CEST	8088	49938	5.188.66.181	192.168.2.7
Jul 20, 2024 02:24:17.099455118 CEST	7749	49927	148.72.210.123	192.168.2.7
Jul 20, 2024 02:24:17.099522114 CEST	49927	7749	192.168.2.7	148.72.210.123
Jul 20, 2024 02:24:17.099682093 CEST	49927	7749	192.168.2.7	148.72.210.123
Jul 20, 2024 02:24:17.105969906 CEST	7749	49927	148.72.210.123	192.168.2.7
Jul 20, 2024 02:24:17.397373915 CEST	33475	49905	178.62.7.98	192.168.2.7
Jul 20, 2024 02:24:17.397452116 CEST	49905	33475	192.168.2.7	178.62.7.98
Jul 20, 2024 02:24:17.397624969 CEST	49905	33475	192.168.2.7	178.62.7.98
Jul 20, 2024 02:24:17.402414083 CEST	33475	49905	178.62.7.98	192.168.2.7
Jul 20, 2024 02:24:17.417351961 CEST	49941	36476	192.168.2.7	1.179.148.9
Jul 20, 2024 02:24:17.423631907 CEST	36476	49941	1.179.148.9	192.168.2.7
Jul 20, 2024 02:24:17.423733950 CEST	49941	36476	192.168.2.7	1.179.148.9
Jul 20, 2024 02:24:17.423974037 CEST	49941	36476	192.168.2.7	1.179.148.9
Jul 20, 2024 02:24:17.430246115 CEST	36476	49941	1.179.148.9	192.168.2.7
Jul 20, 2024 02:24:17.446307898 CEST	80	49934	119.59.101.111	192.168.2.7
Jul 20, 2024 02:24:17.446333885 CEST	80	49934	119.59.101.111	192.168.2.7
Jul 20, 2024 02:24:17.446404934 CEST	49934	80	192.168.2.7	119.59.101.111
Jul 20, 2024 02:24:17.446522951 CEST	49934	80	192.168.2.7	119.59.101.111
Jul 20, 2024 02:24:17.485474110 CEST	4153	49923	185.32.47.105	192.168.2.7
Jul 20, 2024 02:24:17.489361048 CEST	49923	4153	192.168.2.7	185.32.47.105
Jul 20, 2024 02:24:17.489485025 CEST	49923	4153	192.168.2.7	185.32.47.105
Jul 20, 2024 02:24:17.498115063 CEST	4153	49923	185.32.47.105	192.168.2.7
Jul 20, 2024 02:24:17.526263952 CEST	49942	5678	192.168.2.7	103.36.35.251
Jul 20, 2024 02:24:17.531642914 CEST	5678	49942	103.36.35.251	192.168.2.7
Jul 20, 2024 02:24:17.533643961 CEST	49942	5678	192.168.2.7	103.36.35.251
Jul 20, 2024 02:24:17.533889055 CEST	49942	5678	192.168.2.7	103.36.35.251
Jul 20, 2024 02:24:17.538695097 CEST	5678	49942	103.36.35.251	192.168.2.7
Jul 20, 2024 02:24:17.640419006 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:17.645596981 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:17.647222996 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:17.647412062 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:17.652334929 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:18.242571115 CEST	46394	49935	92.205.110.118	192.168.2.7
Jul 20, 2024 02:24:18.242646933 CEST	49935	46394	192.168.2.7	92.205.110.118
Jul 20, 2024 02:24:18.242768049 CEST	49935	46394	192.168.2.7	92.205.110.118
Jul 20, 2024 02:24:18.247806072 CEST	46394	49935	92.205.110.118	192.168.2.7
Jul 20, 2024 02:24:18.268722057 CEST	80	49872	178.20.45.29	192.168.2.7
Jul 20, 2024 02:24:18.268851995 CEST	49872	80	192.168.2.7	178.20.45.29
Jul 20, 2024 02:24:18.268923044 CEST	49872	80	192.168.2.7	178.20.45.29
Jul 20, 2024 02:24:18.273799896 CEST	80	49872	178.20.45.29	192.168.2.7
Jul 20, 2024 02:24:18.279506922 CEST	80	49872	178.20.45.29	192.168.2.7
Jul 20, 2024 02:24:18.279580116 CEST	49872	80	192.168.2.7	178.20.45.29
Jul 20, 2024 02:24:18.329242945 CEST	5430	49862	202.179.184.34	192.168.2.7
Jul 20, 2024 02:24:18.329313040 CEST	49862	5430	192.168.2.7	202.179.184.34
Jul 20, 2024 02:24:18.329430103 CEST	49862	5430	192.168.2.7	202.179.184.34
Jul 20, 2024 02:24:18.334297895 CEST	5430	49862	202.179.184.34	192.168.2.7
Jul 20, 2024 02:24:18.398197889 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:18.400190115 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:18.409401894 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:18.744560003 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:18.744652033 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:18.744730949 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:18.749114990 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:18.754199982 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:19.069642067 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:19.119437933 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:19.454562902 CEST	4145	49897	192.111.138.29	192.168.2.7
Jul 20, 2024 02:24:19.454713106 CEST	49897	4145	192.168.2.7	192.111.138.29
Jul 20, 2024 02:24:19.459178925 CEST	49897	4145	192.168.2.7	192.111.138.29
Jul 20, 2024 02:24:19.459774017 CEST	4145	49897	192.111.138.29	192.168.2.7
Jul 20, 2024 02:24:19.464622021 CEST	4145	49897	192.111.138.29	192.168.2.7
Jul 20, 2024 02:24:19.465311050 CEST	49897	4145	192.168.2.7	192.111.138.29
Jul 20, 2024 02:24:19.647783041 CEST	4145	49900	92.241.66.138	192.168.2.7
Jul 20, 2024 02:24:19.649888039 CEST	49900	4145	192.168.2.7	92.241.66.138
Jul 20, 2024 02:24:19.650054932 CEST	49900	4145	192.168.2.7	92.241.66.138
Jul 20, 2024 02:24:19.654855967 CEST	4145	49900	92.241.66.138	192.168.2.7
Jul 20, 2024 02:24:19.776441097 CEST	31948	49891	1.179.151.165	192.168.2.7
Jul 20, 2024 02:24:19.776676893 CEST	49891	31948	192.168.2.7	1.179.151.165
Jul 20, 2024 02:24:19.776678085 CEST	49891	31948	192.168.2.7	1.179.151.165
Jul 20, 2024 02:24:19.781586885 CEST	31948	49891	1.179.151.165	192.168.2.7
Jul 20, 2024 02:24:19.782390118 CEST	31948	49891	1.179.151.165	192.168.2.7
Jul 20, 2024 02:24:19.782512903 CEST	49891	31948	192.168.2.7	1.179.151.165
Jul 20, 2024 02:24:20.097323895 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:20.097400904 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:20.097601891 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:20.097867012 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:20.097913027 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:20.776273012 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:20.776371956 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:20.780019045 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:20.780055046 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:20.780405998 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:20.784097910 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:20.828510046 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:21.038964987 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:21.039118052 CEST	443	49947	185.172.148.96	192.168.2.7
Jul 20, 2024 02:24:21.039450884 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:21.043692112 CEST	49947	443	192.168.2.7	185.172.148.96
Jul 20, 2024 02:24:21.061609030 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:21.061649084 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.061728001 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:21.062042952 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:21.062058926 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.577250004 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.577342033 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:21.579130888 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:21.579147100 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.579540014 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.580396891 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:21.624499083 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.700153112 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.702239990 CEST	443	49948	104.26.13.205	192.168.2.7
Jul 20, 2024 02:24:21.707257986 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:21.707484961 CEST	49948	443	192.168.2.7	104.26.13.205
Jul 20, 2024 02:24:22.042131901 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:22.051383018 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:22.051453114 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:22.058708906 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:22.567120075 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:22.619465113 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:22.711469889 CEST	57728	49943	70.166.167.38	192.168.2.7
Jul 20, 2024 02:24:22.760093927 CEST	49943	57728	192.168.2.7	70.166.167.38
Jul 20, 2024 02:24:26.741965055 CEST	3373	49717	199.233.238.6	192.168.2.7
Jul 20, 2024 02:24:26.742213964 CEST	49717	3373	192.168.2.7	199.233.238.6
Jul 20, 2024 02:24:26.742459059 CEST	49717	3373	192.168.2.7	199.233.238.6
Jul 20, 2024 02:24:26.742589951 CEST	4153	49712	177.85.157.25	192.168.2.7
Jul 20, 2024 02:24:26.742657900 CEST	49712	4153	192.168.2.7	177.85.157.25
Jul 20, 2024 02:24:26.742856979 CEST	49712	4153	192.168.2.7	177.85.157.25
Jul 20, 2024 02:24:26.743122101 CEST	38930	49700	23.105.170.33	192.168.2.7
Jul 20, 2024 02:24:26.743185997 CEST	49700	38930	192.168.2.7	23.105.170.33
Jul 20, 2024 02:24:26.743263006 CEST	49700	38930	192.168.2.7	23.105.170.33
Jul 20, 2024 02:24:26.745574951 CEST	15062	49706	51.81.31.64	192.168.2.7
Jul 20, 2024 02:24:26.745662928 CEST	49706	15062	192.168.2.7	51.81.31.64
Jul 20, 2024 02:24:26.745780945 CEST	49706	15062	192.168.2.7	51.81.31.64
Jul 20, 2024 02:24:26.746216059 CEST	37209	49701	190.12.95.170	192.168.2.7
Jul 20, 2024 02:24:26.746284008 CEST	49701	37209	192.168.2.7	190.12.95.170
Jul 20, 2024 02:24:26.746366024 CEST	49701	37209	192.168.2.7	190.12.95.170
Jul 20, 2024 02:24:26.747584105 CEST	24093	49710	115.73.130.122	192.168.2.7
Jul 20, 2024 02:24:26.747649908 CEST	49710	24093	192.168.2.7	115.73.130.122
Jul 20, 2024 02:24:26.747740984 CEST	49710	24093	192.168.2.7	115.73.130.122
Jul 20, 2024 02:24:26.748322010 CEST	3373	49717	199.233.238.6	192.168.2.7
Jul 20, 2024 02:24:26.748847961 CEST	4153	49712	177.85.157.25	192.168.2.7
Jul 20, 2024 02:24:26.750722885 CEST	38930	49700	23.105.170.33	192.168.2.7
Jul 20, 2024 02:24:26.750911951 CEST	15062	49706	51.81.31.64	192.168.2.7
Jul 20, 2024 02:24:26.752347946 CEST	37209	49701	190.12.95.170	192.168.2.7
Jul 20, 2024 02:24:26.753477097 CEST	24093	49710	115.73.130.122	192.168.2.7
Jul 20, 2024 02:24:26.758902073 CEST	4145	49722	168.227.158.65	192.168.2.7
Jul 20, 2024 02:24:26.758977890 CEST	49722	4145	192.168.2.7	168.227.158.65
Jul 20, 2024 02:24:26.759087086 CEST	49722	4145	192.168.2.7	168.227.158.65
Jul 20, 2024 02:24:26.760940075 CEST	5678	49708	177.104.87.23	192.168.2.7
Jul 20, 2024 02:24:26.761008978 CEST	49708	5678	192.168.2.7	177.104.87.23
Jul 20, 2024 02:24:26.761115074 CEST	49708	5678	192.168.2.7	177.104.87.23
Jul 20, 2024 02:24:26.765459061 CEST	4145	49722	168.227.158.65	192.168.2.7
Jul 20, 2024 02:24:26.766808987 CEST	5678	49708	177.104.87.23	192.168.2.7
Jul 20, 2024 02:24:26.774460077 CEST	15722	49704	195.154.43.198	192.168.2.7
Jul 20, 2024 02:24:26.774534941 CEST	49704	15722	192.168.2.7	195.154.43.198
Jul 20, 2024 02:24:26.774630070 CEST	49704	15722	192.168.2.7	195.154.43.198
Jul 20, 2024 02:24:26.774733067 CEST	62909	49711	173.212.205.144	192.168.2.7
Jul 20, 2024 02:24:26.774786949 CEST	49711	62909	192.168.2.7	173.212.205.144
Jul 20, 2024 02:24:26.774889946 CEST	49711	62909	192.168.2.7	173.212.205.144
Jul 20, 2024 02:24:26.774930954 CEST	4145	49720	190.108.84.168	192.168.2.7
Jul 20, 2024 02:24:26.774986029 CEST	49720	4145	192.168.2.7	190.108.84.168
Jul 20, 2024 02:24:26.775151014 CEST	49720	4145	192.168.2.7	190.108.84.168
Jul 20, 2024 02:24:26.776539087 CEST	5678	49726	103.87.81.86	192.168.2.7
Jul 20, 2024 02:24:26.776612043 CEST	49726	5678	192.168.2.7	103.87.81.86
Jul 20, 2024 02:24:26.776691914 CEST	49726	5678	192.168.2.7	103.87.81.86
Jul 20, 2024 02:24:26.776825905 CEST	61912	49723	161.97.163.52	192.168.2.7
Jul 20, 2024 02:24:26.776887894 CEST	49723	61912	192.168.2.7	161.97.163.52
Jul 20, 2024 02:24:26.776940107 CEST	49723	61912	192.168.2.7	161.97.163.52
Jul 20, 2024 02:24:26.778800011 CEST	1080	49715	1.179.148.33	192.168.2.7
Jul 20, 2024 02:24:26.778875113 CEST	49715	1080	192.168.2.7	1.179.148.33
Jul 20, 2024 02:24:26.778940916 CEST	49715	1080	192.168.2.7	1.179.148.33
Jul 20, 2024 02:24:26.779810905 CEST	15722	49704	195.154.43.198	192.168.2.7
Jul 20, 2024 02:24:26.779863119 CEST	62909	49711	173.212.205.144	192.168.2.7
Jul 20, 2024 02:24:26.780272007 CEST	4145	49720	190.108.84.168	192.168.2.7
Jul 20, 2024 02:24:26.781531096 CEST	5678	49726	103.87.81.86	192.168.2.7
Jul 20, 2024 02:24:26.782804012 CEST	61912	49723	161.97.163.52	192.168.2.7
Jul 20, 2024 02:24:26.783938885 CEST	1080	49715	1.179.148.33	192.168.2.7
Jul 20, 2024 02:24:26.819401979 CEST	8833	49739	76.26.105.162	192.168.2.7
Jul 20, 2024 02:24:26.819540024 CEST	49739	8833	192.168.2.7	76.26.105.162
Jul 20, 2024 02:24:26.819660902 CEST	49739	8833	192.168.2.7	76.26.105.162
Jul 20, 2024 02:24:26.819811106 CEST	62979	49760	66.23.233.210	192.168.2.7
Jul 20, 2024 02:24:26.819890022 CEST	49760	62979	192.168.2.7	66.23.233.210
Jul 20, 2024 02:24:26.820041895 CEST	49760	62979	192.168.2.7	66.23.233.210
Jul 20, 2024 02:24:26.821152925 CEST	4145	49743	189.201.191.18	192.168.2.7
Jul 20, 2024 02:24:26.821228027 CEST	49743	4145	192.168.2.7	189.201.191.18
Jul 20, 2024 02:24:26.821285009 CEST	49743	4145	192.168.2.7	189.201.191.18
Jul 20, 2024 02:24:26.821522951 CEST	8080	49737	34.124.190.108	192.168.2.7
Jul 20, 2024 02:24:26.821584940 CEST	49737	8080	192.168.2.7	34.124.190.108
Jul 20, 2024 02:24:26.821667910 CEST	49737	8080	192.168.2.7	34.124.190.108
Jul 20, 2024 02:24:26.821897030 CEST	8080	49740	139.180.169.114	192.168.2.7
Jul 20, 2024 02:24:26.821969986 CEST	49740	8080	192.168.2.7	139.180.169.114
Jul 20, 2024 02:24:26.822052002 CEST	49740	8080	192.168.2.7	139.180.169.114
Jul 20, 2024 02:24:26.824785948 CEST	8833	49739	76.26.105.162	192.168.2.7
Jul 20, 2024 02:24:26.825031042 CEST	62979	49760	66.23.233.210	192.168.2.7
Jul 20, 2024 02:24:26.826302052 CEST	4145	49743	189.201.191.18	192.168.2.7
Jul 20, 2024 02:24:26.826697111 CEST	8080	49737	34.124.190.108	192.168.2.7
Jul 20, 2024 02:24:26.827166080 CEST	8080	49740	139.180.169.114	192.168.2.7
Jul 20, 2024 02:24:26.827450037 CEST	4153	49735	103.81.117.225	192.168.2.7
Jul 20, 2024 02:24:26.827507973 CEST	49735	4153	192.168.2.7	103.81.117.225
Jul 20, 2024 02:24:26.827564001 CEST	49735	4153	192.168.2.7	103.81.117.225
Jul 20, 2024 02:24:26.832916021 CEST	4153	49735	103.81.117.225	192.168.2.7
Jul 20, 2024 02:24:26.837167025 CEST	60606	49753	5.22.154.50	192.168.2.7
Jul 20, 2024 02:24:26.837234020 CEST	49753	60606	192.168.2.7	5.22.154.50
Jul 20, 2024 02:24:26.837328911 CEST	49753	60606	192.168.2.7	5.22.154.50
Jul 20, 2024 02:24:26.837605000 CEST	32688	49751	64.124.191.98	192.168.2.7
Jul 20, 2024 02:24:26.837673903 CEST	49751	32688	192.168.2.7	64.124.191.98
Jul 20, 2024 02:24:26.837733030 CEST	49751	32688	192.168.2.7	64.124.191.98
Jul 20, 2024 02:24:26.843774080 CEST	60606	49753	5.22.154.50	192.168.2.7
Jul 20, 2024 02:24:26.843818903 CEST	32688	49751	64.124.191.98	192.168.2.7
Jul 20, 2024 02:24:26.852675915 CEST	80	49761	189.175.197.223	192.168.2.7
Jul 20, 2024 02:24:26.852761984 CEST	49761	80	192.168.2.7	189.175.197.223
Jul 20, 2024 02:24:26.852852106 CEST	49761	80	192.168.2.7	189.175.197.223
Jul 20, 2024 02:24:26.857239008 CEST	5678	49777	201.221.134.74	192.168.2.7
Jul 20, 2024 02:24:26.857330084 CEST	49777	5678	192.168.2.7	201.221.134.74
Jul 20, 2024 02:24:26.857424021 CEST	49777	5678	192.168.2.7	201.221.134.74
Jul 20, 2024 02:24:26.857508898 CEST	80	49766	93.158.155.18	192.168.2.7
Jul 20, 2024 02:24:26.857567072 CEST	49766	80	192.168.2.7	93.158.155.18
Jul 20, 2024 02:24:26.857677937 CEST	49766	80	192.168.2.7	93.158.155.18
Jul 20, 2024 02:24:26.857856989 CEST	80	49761	189.175.197.223	192.168.2.7
Jul 20, 2024 02:24:26.862663031 CEST	5678	49777	201.221.134.74	192.168.2.7
Jul 20, 2024 02:24:26.862708092 CEST	80	49766	93.158.155.18	192.168.2.7
Jul 20, 2024 02:24:26.865973949 CEST	32100	49783	50.250.205.21	192.168.2.7
Jul 20, 2024 02:24:26.866168022 CEST	49783	32100	192.168.2.7	50.250.205.21
Jul 20, 2024 02:24:26.866168976 CEST	49783	32100	192.168.2.7	50.250.205.21
Jul 20, 2024 02:24:26.868545055 CEST	80	49767	189.226.237.127	192.168.2.7
Jul 20, 2024 02:24:26.868628025 CEST	49767	80	192.168.2.7	189.226.237.127
Jul 20, 2024 02:24:26.868697882 CEST	49767	80	192.168.2.7	189.226.237.127
Jul 20, 2024 02:24:26.871151924 CEST	32100	49783	50.250.205.21	192.168.2.7
Jul 20, 2024 02:24:26.872474909 CEST	4145	49770	78.133.163.190	192.168.2.7
Jul 20, 2024 02:24:26.872545004 CEST	49770	4145	192.168.2.7	78.133.163.190
Jul 20, 2024 02:24:26.872678041 CEST	49770	4145	192.168.2.7	78.133.163.190
Jul 20, 2024 02:24:26.874733925 CEST	80	49767	189.226.237.127	192.168.2.7
Jul 20, 2024 02:24:26.877681017 CEST	4145	49770	78.133.163.190	192.168.2.7
Jul 20, 2024 02:24:26.898047924 CEST	5678	49792	142.166.131.50	192.168.2.7
Jul 20, 2024 02:24:26.898264885 CEST	49792	5678	192.168.2.7	142.166.131.50
Jul 20, 2024 02:24:26.898448944 CEST	49792	5678	192.168.2.7	142.166.131.50
Jul 20, 2024 02:24:26.898650885 CEST	1080	49786	102.219.33.118	192.168.2.7
Jul 20, 2024 02:24:26.898718119 CEST	49786	1080	192.168.2.7	102.219.33.118
Jul 20, 2024 02:24:26.899266958 CEST	44909	49791	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:26.899270058 CEST	49786	1080	192.168.2.7	102.219.33.118
Jul 20, 2024 02:24:26.899455070 CEST	49791	44909	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:26.899456024 CEST	49791	44909	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:26.899745941 CEST	4145	49795	183.6.7.103	192.168.2.7
Jul 20, 2024 02:24:26.899800062 CEST	49795	4145	192.168.2.7	183.6.7.103
Jul 20, 2024 02:24:26.899997950 CEST	59391	49785	181.143.106.162	192.168.2.7
Jul 20, 2024 02:24:26.900048971 CEST	49785	59391	192.168.2.7	181.143.106.162
Jul 20, 2024 02:24:26.900692940 CEST	49795	4145	192.168.2.7	183.6.7.103
Jul 20, 2024 02:24:26.901335955 CEST	49785	59391	192.168.2.7	181.143.106.162
Jul 20, 2024 02:24:26.903757095 CEST	5678	49792	142.166.131.50	192.168.2.7
Jul 20, 2024 02:24:26.904155016 CEST	1080	49786	102.219.33.118	192.168.2.7
Jul 20, 2024 02:24:26.904548883 CEST	44909	49791	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:26.905657053 CEST	4145	49795	183.6.7.103	192.168.2.7
Jul 20, 2024 02:24:26.906621933 CEST	59391	49785	181.143.106.162	192.168.2.7
Jul 20, 2024 02:24:26.919348001 CEST	5678	49787	91.247.92.63	192.168.2.7
Jul 20, 2024 02:24:26.919537067 CEST	49787	5678	192.168.2.7	91.247.92.63
Jul 20, 2024 02:24:26.919537067 CEST	49787	5678	192.168.2.7	91.247.92.63
Jul 20, 2024 02:24:26.924702883 CEST	5678	49787	91.247.92.63	192.168.2.7
Jul 20, 2024 02:24:27.366694927 CEST	8081	49802	137.141.148.79	192.168.2.7
Jul 20, 2024 02:24:27.366822958 CEST	49802	8081	192.168.2.7	137.141.148.79
Jul 20, 2024 02:24:27.367054939 CEST	49802	8081	192.168.2.7	137.141.148.79
Jul 20, 2024 02:24:27.372225046 CEST	8081	49802	137.141.148.79	192.168.2.7
Jul 20, 2024 02:24:27.446336031 CEST	1628	49810	181.214.152.204	192.168.2.7
Jul 20, 2024 02:24:27.446435928 CEST	49810	1628	192.168.2.7	181.214.152.204
Jul 20, 2024 02:24:27.446567059 CEST	49810	1628	192.168.2.7	181.214.152.204
Jul 20, 2024 02:24:27.448107004 CEST	5678	49803	196.43.106.62	192.168.2.7
Jul 20, 2024 02:24:27.448168993 CEST	49803	5678	192.168.2.7	196.43.106.62
Jul 20, 2024 02:24:27.448311090 CEST	49803	5678	192.168.2.7	196.43.106.62
Jul 20, 2024 02:24:27.452801943 CEST	1628	49810	181.214.152.204	192.168.2.7
Jul 20, 2024 02:24:27.454430103 CEST	5678	49803	196.43.106.62	192.168.2.7
Jul 20, 2024 02:24:27.575937986 CEST	5678	49811	36.95.13.18	192.168.2.7
Jul 20, 2024 02:24:27.576045036 CEST	49811	5678	192.168.2.7	36.95.13.18
Jul 20, 2024 02:24:27.576221943 CEST	49811	5678	192.168.2.7	36.95.13.18
Jul 20, 2024 02:24:27.582330942 CEST	5678	49811	36.95.13.18	192.168.2.7
Jul 20, 2024 02:24:27.917963982 CEST	45028	49718	95.111.227.164	192.168.2.7
Jul 20, 2024 02:24:27.918103933 CEST	49718	45028	192.168.2.7	95.111.227.164
Jul 20, 2024 02:24:27.918421984 CEST	49718	45028	192.168.2.7	95.111.227.164
Jul 20, 2024 02:24:27.923537016 CEST	45028	49718	95.111.227.164	192.168.2.7
Jul 20, 2024 02:24:28.196594954 CEST	55713	49821	177.38.245.106	192.168.2.7
Jul 20, 2024 02:24:28.196693897 CEST	49821	55713	192.168.2.7	177.38.245.106
Jul 20, 2024 02:24:28.196885109 CEST	49821	55713	192.168.2.7	177.38.245.106
Jul 20, 2024 02:24:28.201817036 CEST	55713	49821	177.38.245.106	192.168.2.7
Jul 20, 2024 02:24:28.321563005 CEST	1080	49826	45.234.100.102	192.168.2.7
Jul 20, 2024 02:24:28.321655035 CEST	49826	1080	192.168.2.7	45.234.100.102
Jul 20, 2024 02:24:28.321861982 CEST	49826	1080	192.168.2.7	45.234.100.102
Jul 20, 2024 02:24:28.323235989 CEST	4145	49823	177.126.86.78	192.168.2.7
Jul 20, 2024 02:24:28.323333025 CEST	49823	4145	192.168.2.7	177.126.86.78
Jul 20, 2024 02:24:28.323462009 CEST	49823	4145	192.168.2.7	177.126.86.78
Jul 20, 2024 02:24:28.327153921 CEST	1080	49826	45.234.100.102	192.168.2.7
Jul 20, 2024 02:24:28.328416109 CEST	4145	49823	177.126.86.78	192.168.2.7
Jul 20, 2024 02:24:28.369595051 CEST	4444	49825	193.143.1.201	192.168.2.7
Jul 20, 2024 02:24:28.369709015 CEST	49825	4444	192.168.2.7	193.143.1.201
Jul 20, 2024 02:24:28.369900942 CEST	49825	4444	192.168.2.7	193.143.1.201
Jul 20, 2024 02:24:28.374727011 CEST	4444	49825	193.143.1.201	192.168.2.7
Jul 20, 2024 02:24:28.464832067 CEST	41762	49835	103.253.153.242	192.168.2.7
Jul 20, 2024 02:24:28.465023041 CEST	49835	41762	192.168.2.7	103.253.153.242
Jul 20, 2024 02:24:28.465090036 CEST	49835	41762	192.168.2.7	103.253.153.242
Jul 20, 2024 02:24:28.470031023 CEST	41762	49835	103.253.153.242	192.168.2.7
Jul 20, 2024 02:24:28.573518991 CEST	8080	49837	77.64.42.173	192.168.2.7
Jul 20, 2024 02:24:28.573620081 CEST	49837	8080	192.168.2.7	77.64.42.173
Jul 20, 2024 02:24:28.573730946 CEST	49837	8080	192.168.2.7	77.64.42.173
Jul 20, 2024 02:24:28.574062109 CEST	3629	49838	190.138.250.48	192.168.2.7
Jul 20, 2024 02:24:28.574119091 CEST	49838	3629	192.168.2.7	190.138.250.48
Jul 20, 2024 02:24:28.574242115 CEST	49838	3629	192.168.2.7	190.138.250.48
Jul 20, 2024 02:24:28.578964949 CEST	8080	49837	77.64.42.173	192.168.2.7
Jul 20, 2024 02:24:28.579190969 CEST	3629	49838	190.138.250.48	192.168.2.7
Jul 20, 2024 02:24:28.992994070 CEST	61359	49841	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:28.993180037 CEST	49841	61359	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:28.993359089 CEST	49841	61359	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:28.997524023 CEST	26530	49840	178.255.44.62	192.168.2.7
Jul 20, 2024 02:24:28.997742891 CEST	49840	26530	192.168.2.7	178.255.44.62
Jul 20, 2024 02:24:28.997742891 CEST	49840	26530	192.168.2.7	178.255.44.62
Jul 20, 2024 02:24:29.002887011 CEST	61359	49841	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:29.006675959 CEST	26530	49840	178.255.44.62	192.168.2.7
Jul 20, 2024 02:24:29.120332956 CEST	44826	49844	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:29.120542049 CEST	49844	44826	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:29.120702028 CEST	49844	44826	192.168.2.7	162.214.121.173
Jul 20, 2024 02:24:29.129853010 CEST	44826	49844	162.214.121.173	192.168.2.7
Jul 20, 2024 02:24:29.212460041 CEST	51069	49846	162.214.227.68	192.168.2.7
Jul 20, 2024 02:24:29.212563992 CEST	49846	51069	192.168.2.7	162.214.227.68
Jul 20, 2024 02:24:29.212775946 CEST	49846	51069	192.168.2.7	162.214.227.68
Jul 20, 2024 02:24:29.221043110 CEST	51069	49846	162.214.227.68	192.168.2.7
Jul 20, 2024 02:24:29.226496935 CEST	4153	49848	182.253.146.155	192.168.2.7
Jul 20, 2024 02:24:29.226705074 CEST	49848	4153	192.168.2.7	182.253.146.155
Jul 20, 2024 02:24:29.226850033 CEST	49848	4153	192.168.2.7	182.253.146.155
Jul 20, 2024 02:24:29.231601954 CEST	4153	49848	182.253.146.155	192.168.2.7
Jul 20, 2024 02:24:29.243367910 CEST	49923	49851	186.219.96.47	192.168.2.7
Jul 20, 2024 02:24:29.243558884 CEST	49851	49923	192.168.2.7	186.219.96.47
Jul 20, 2024 02:24:29.243560076 CEST	49851	49923	192.168.2.7	186.219.96.47
Jul 20, 2024 02:24:29.247281075 CEST	80	49847	142.138.80.36	192.168.2.7
Jul 20, 2024 02:24:29.247363091 CEST	49847	80	192.168.2.7	142.138.80.36
Jul 20, 2024 02:24:29.247514009 CEST	49847	80	192.168.2.7	142.138.80.36
Jul 20, 2024 02:24:29.250726938 CEST	49923	49851	186.219.96.47	192.168.2.7
Jul 20, 2024 02:24:29.253956079 CEST	80	49847	142.138.80.36	192.168.2.7
Jul 20, 2024 02:24:29.446721077 CEST	31001	49854	86.138.234.109	192.168.2.7
Jul 20, 2024 02:24:29.446849108 CEST	49854	31001	192.168.2.7	86.138.234.109
Jul 20, 2024 02:24:29.447000980 CEST	49854	31001	192.168.2.7	86.138.234.109
Jul 20, 2024 02:24:29.452038050 CEST	31001	49854	86.138.234.109	192.168.2.7
Jul 20, 2024 02:24:29.466897011 CEST	1081	49855	198.23.143.4	192.168.2.7
Jul 20, 2024 02:24:29.467006922 CEST	49855	1081	192.168.2.7	198.23.143.4
Jul 20, 2024 02:24:29.467107058 CEST	49855	1081	192.168.2.7	198.23.143.4
Jul 20, 2024 02:24:29.472598076 CEST	1081	49855	198.23.143.4	192.168.2.7
Jul 20, 2024 02:24:29.790716887 CEST	5678	49857	81.16.1.71	192.168.2.7
Jul 20, 2024 02:24:29.790954113 CEST	49857	5678	192.168.2.7	81.16.1.71
Jul 20, 2024 02:24:29.791044950 CEST	49857	5678	192.168.2.7	81.16.1.71
Jul 20, 2024 02:24:29.791352987 CEST	59076	49858	207.244.229.34	192.168.2.7
Jul 20, 2024 02:24:29.791414022 CEST	49858	59076	192.168.2.7	207.244.229.34
Jul 20, 2024 02:24:29.791541100 CEST	49858	59076	192.168.2.7	207.244.229.34
Jul 20, 2024 02:24:29.796276093 CEST	5678	49857	81.16.1.71	192.168.2.7
Jul 20, 2024 02:24:29.796547890 CEST	59076	49858	207.244.229.34	192.168.2.7
Jul 20, 2024 02:24:29.825380087 CEST	44550	49863	190.144.224.182	192.168.2.7
Jul 20, 2024 02:24:29.825542927 CEST	49863	44550	192.168.2.7	190.144.224.182
Jul 20, 2024 02:24:29.825576067 CEST	49863	44550	192.168.2.7	190.144.224.182
Jul 20, 2024 02:24:29.825736046 CEST	4153	49864	181.225.78.66	192.168.2.7
Jul 20, 2024 02:24:29.825798988 CEST	49864	4153	192.168.2.7	181.225.78.66
Jul 20, 2024 02:24:29.825884104 CEST	49864	4153	192.168.2.7	181.225.78.66
Jul 20, 2024 02:24:29.827644110 CEST	49497	49860	162.214.103.84	192.168.2.7
Jul 20, 2024 02:24:29.827702999 CEST	49860	49497	192.168.2.7	162.214.103.84
Jul 20, 2024 02:24:29.827785015 CEST	49860	49497	192.168.2.7	162.214.103.84
Jul 20, 2024 02:24:29.830765963 CEST	44550	49863	190.144.224.182	192.168.2.7
Jul 20, 2024 02:24:29.831140041 CEST	4153	49864	181.225.78.66	192.168.2.7
Jul 20, 2024 02:24:29.832629919 CEST	49497	49860	162.214.103.84	192.168.2.7
Jul 20, 2024 02:24:29.839102983 CEST	56921	49865	91.150.77.57	192.168.2.7
Jul 20, 2024 02:24:29.839190960 CEST	49865	56921	192.168.2.7	91.150.77.57
Jul 20, 2024 02:24:29.839390993 CEST	49865	56921	192.168.2.7	91.150.77.57
Jul 20, 2024 02:24:29.839818954 CEST	5678	49867	213.16.81.147	192.168.2.7
Jul 20, 2024 02:24:29.839880943 CEST	49867	5678	192.168.2.7	213.16.81.147
Jul 20, 2024 02:24:29.839946985 CEST	49867	5678	192.168.2.7	213.16.81.147
Jul 20, 2024 02:24:29.849690914 CEST	56921	49865	91.150.77.57	192.168.2.7
Jul 20, 2024 02:24:29.849731922 CEST	5678	49867	213.16.81.147	192.168.2.7
Jul 20, 2024 02:24:30.034259081 CEST	32755	49873	154.68.43.182	192.168.2.7
Jul 20, 2024 02:24:30.034390926 CEST	49873	32755	192.168.2.7	154.68.43.182
Jul 20, 2024 02:24:30.034671068 CEST	49873	32755	192.168.2.7	154.68.43.182
Jul 20, 2024 02:24:30.040200949 CEST	32755	49873	154.68.43.182	192.168.2.7
Jul 20, 2024 02:24:30.153492928 CEST	4145	49874	200.214.154.135	192.168.2.7
Jul 20, 2024 02:24:30.153707981 CEST	49874	4145	192.168.2.7	200.214.154.135
Jul 20, 2024 02:24:30.153834105 CEST	49874	4145	192.168.2.7	200.214.154.135
Jul 20, 2024 02:24:30.158751011 CEST	4145	49874	200.214.154.135	192.168.2.7
Jul 20, 2024 02:24:30.446820974 CEST	4153	49881	1.9.27.219	192.168.2.7
Jul 20, 2024 02:24:30.447068930 CEST	49881	4153	192.168.2.7	1.9.27.219
Jul 20, 2024 02:24:30.447179079 CEST	49881	4153	192.168.2.7	1.9.27.219
Jul 20, 2024 02:24:30.453010082 CEST	4153	49881	1.9.27.219	192.168.2.7
Jul 20, 2024 02:24:30.493851900 CEST	5678	49879	154.79.250.48	192.168.2.7
Jul 20, 2024 02:24:30.493927002 CEST	49879	5678	192.168.2.7	154.79.250.48
Jul 20, 2024 02:24:30.494050026 CEST	49879	5678	192.168.2.7	154.79.250.48
Jul 20, 2024 02:24:30.499031067 CEST	5678	49879	154.79.250.48	192.168.2.7
Jul 20, 2024 02:24:30.499408960 CEST	5678	49878	103.10.99.110	192.168.2.7
Jul 20, 2024 02:24:30.499478102 CEST	49878	5678	192.168.2.7	103.10.99.110
Jul 20, 2024 02:24:30.499560118 CEST	49878	5678	192.168.2.7	103.10.99.110
Jul 20, 2024 02:24:30.504393101 CEST	5678	49878	103.10.99.110	192.168.2.7
Jul 20, 2024 02:24:30.697660923 CEST	31476	49884	170.244.64.12	192.168.2.7
Jul 20, 2024 02:24:30.697738886 CEST	49884	31476	192.168.2.7	170.244.64.12
Jul 20, 2024 02:24:30.697930098 CEST	49884	31476	192.168.2.7	170.244.64.12
Jul 20, 2024 02:24:30.702923059 CEST	31476	49884	170.244.64.12	192.168.2.7
Jul 20, 2024 02:24:30.794384956 CEST	40736	49886	138.255.240.66	192.168.2.7
Jul 20, 2024 02:24:30.794630051 CEST	49886	40736	192.168.2.7	138.255.240.66
Jul 20, 2024 02:24:30.794814110 CEST	49886	40736	192.168.2.7	138.255.240.66
Jul 20, 2024 02:24:30.800869942 CEST	40736	49886	138.255.240.66	192.168.2.7
Jul 20, 2024 02:24:31.012638092 CEST	5678	49889	46.219.1.5	192.168.2.7
Jul 20, 2024 02:24:31.012752056 CEST	49889	5678	192.168.2.7	46.219.1.5
Jul 20, 2024 02:24:31.012938023 CEST	49889	5678	192.168.2.7	46.219.1.5
Jul 20, 2024 02:24:31.019345999 CEST	5678	49889	46.219.1.5	192.168.2.7
Jul 20, 2024 02:24:31.118839979 CEST	23087	49890	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:31.119141102 CEST	49890	23087	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:31.119462967 CEST	49890	23087	192.168.2.7	184.168.121.153
Jul 20, 2024 02:24:31.123213053 CEST	34159	49892	77.65.50.118	192.168.2.7
Jul 20, 2024 02:24:31.123323917 CEST	49892	34159	192.168.2.7	77.65.50.118
Jul 20, 2024 02:24:31.123434067 CEST	49892	34159	192.168.2.7	77.65.50.118
Jul 20, 2024 02:24:31.126774073 CEST	23087	49890	184.168.121.153	192.168.2.7
Jul 20, 2024 02:24:31.129863977 CEST	34159	49892	77.65.50.118	192.168.2.7
Jul 20, 2024 02:24:31.242700100 CEST	5678	49896	103.79.152.204	192.168.2.7
Jul 20, 2024 02:24:31.242945910 CEST	49896	5678	192.168.2.7	103.79.152.204
Jul 20, 2024 02:24:31.243029118 CEST	49896	5678	192.168.2.7	103.79.152.204
Jul 20, 2024 02:24:31.249552011 CEST	5678	49894	115.85.86.114	192.168.2.7
Jul 20, 2024 02:24:31.249644041 CEST	49894	5678	192.168.2.7	115.85.86.114
Jul 20, 2024 02:24:31.249717951 CEST	49894	5678	192.168.2.7	115.85.86.114
Jul 20, 2024 02:24:31.250418901 CEST	5678	49896	103.79.152.204	192.168.2.7
Jul 20, 2024 02:24:31.256953955 CEST	5678	49894	115.85.86.114	192.168.2.7
Jul 20, 2024 02:24:31.261565924 CEST	5678	49898	103.182.52.159	192.168.2.7
Jul 20, 2024 02:24:31.261667967 CEST	49898	5678	192.168.2.7	103.182.52.159
Jul 20, 2024 02:24:31.261915922 CEST	49898	5678	192.168.2.7	103.182.52.159
Jul 20, 2024 02:24:31.268821955 CEST	5678	49898	103.182.52.159	192.168.2.7
Jul 20, 2024 02:24:31.322283983 CEST	58563	49899	103.111.22.65	192.168.2.7
Jul 20, 2024 02:24:31.322489023 CEST	49899	58563	192.168.2.7	103.111.22.65
Jul 20, 2024 02:24:31.322607040 CEST	49899	58563	192.168.2.7	103.111.22.65
Jul 20, 2024 02:24:31.330015898 CEST	58563	49899	103.111.22.65	192.168.2.7
Jul 20, 2024 02:24:31.368521929 CEST	110	49901	78.146.180.112	192.168.2.7
Jul 20, 2024 02:24:31.368593931 CEST	49901	110	192.168.2.7	78.146.180.112
Jul 20, 2024 02:24:31.368725061 CEST	49901	110	192.168.2.7	78.146.180.112
Jul 20, 2024 02:24:31.373692036 CEST	110	49901	78.146.180.112	192.168.2.7
Jul 20, 2024 02:24:31.681534052 CEST	4153	49906	182.253.246.213	192.168.2.7
Jul 20, 2024 02:24:31.681638956 CEST	49906	4153	192.168.2.7	182.253.246.213
Jul 20, 2024 02:24:31.681797981 CEST	49906	4153	192.168.2.7	182.253.246.213
Jul 20, 2024 02:24:31.686750889 CEST	4153	49906	182.253.246.213	192.168.2.7
Jul 20, 2024 02:24:31.917586088 CEST	42021	49908	162.241.45.22	192.168.2.7
Jul 20, 2024 02:24:31.917829037 CEST	49908	42021	192.168.2.7	162.241.45.22
Jul 20, 2024 02:24:31.917829037 CEST	49908	42021	192.168.2.7	162.241.45.22
Jul 20, 2024 02:24:31.923064947 CEST	42021	49908	162.241.45.22	192.168.2.7
Jul 20, 2024 02:24:32.233511925 CEST	80	49910	103.152.112.234	192.168.2.7
Jul 20, 2024 02:24:32.233808041 CEST	49910	80	192.168.2.7	103.152.112.234
Jul 20, 2024 02:24:32.233808041 CEST	49910	80	192.168.2.7	103.152.112.234
Jul 20, 2024 02:24:32.239686012 CEST	80	49910	103.152.112.234	192.168.2.7
Jul 20, 2024 02:24:33.322031021 CEST	1080	49915	200.85.169.221	192.168.2.7
Jul 20, 2024 02:24:33.322171926 CEST	49915	1080	192.168.2.7	200.85.169.221
Jul 20, 2024 02:24:33.322336912 CEST	49915	1080	192.168.2.7	200.85.169.221
Jul 20, 2024 02:24:33.327256918 CEST	1080	49915	200.85.169.221	192.168.2.7
Jul 20, 2024 02:24:33.794702053 CEST	1080	49917	103.47.93.236	192.168.2.7
Jul 20, 2024 02:24:33.794790030 CEST	49917	1080	192.168.2.7	103.47.93.236
Jul 20, 2024 02:24:33.794926882 CEST	49917	1080	192.168.2.7	103.47.93.236
Jul 20, 2024 02:24:33.800307989 CEST	1080	49917	103.47.93.236	192.168.2.7
Jul 20, 2024 02:24:33.877393007 CEST	4153	49920	45.251.57.49	192.168.2.7
Jul 20, 2024 02:24:33.877616882 CEST	49920	4153	192.168.2.7	45.251.57.49
Jul 20, 2024 02:24:33.877774954 CEST	49920	4153	192.168.2.7	45.251.57.49
Jul 20, 2024 02:24:33.884629011 CEST	4153	49920	45.251.57.49	192.168.2.7
Jul 20, 2024 02:24:35.399621010 CEST	5678	49924	141.105.107.152	192.168.2.7
Jul 20, 2024 02:24:35.399799109 CEST	49924	5678	192.168.2.7	141.105.107.152
Jul 20, 2024 02:24:35.399853945 CEST	49924	5678	192.168.2.7	141.105.107.152
Jul 20, 2024 02:24:35.405096054 CEST	5678	49924	141.105.107.152	192.168.2.7
Jul 20, 2024 02:24:35.416702986 CEST	49729	5678	192.168.2.7	83.235.22.245
Jul 20, 2024 02:24:35.422136068 CEST	5678	49729	83.235.22.245	192.168.2.7
Jul 20, 2024 02:24:35.422198057 CEST	49729	5678	192.168.2.7	83.235.22.245
Jul 20, 2024 02:24:36.277012110 CEST	4145	49926	103.121.214.50	192.168.2.7
Jul 20, 2024 02:24:36.277112007 CEST	49926	4145	192.168.2.7	103.121.214.50
Jul 20, 2024 02:24:36.277292967 CEST	49926	4145	192.168.2.7	103.121.214.50
Jul 20, 2024 02:24:36.299549103 CEST	4145	49926	103.121.214.50	192.168.2.7
Jul 20, 2024 02:24:36.509272099 CEST	24949	49930	162.214.75.237	192.168.2.7
Jul 20, 2024 02:24:36.509423018 CEST	49930	24949	192.168.2.7	162.214.75.237
Jul 20, 2024 02:24:36.509566069 CEST	49930	24949	192.168.2.7	162.214.75.237
Jul 20, 2024 02:24:36.514415026 CEST	24949	49930	162.214.75.237	192.168.2.7
Jul 20, 2024 02:24:37.076102018 CEST	15473	49931	45.124.84.110	192.168.2.7
Jul 20, 2024 02:24:37.076196909 CEST	49931	15473	192.168.2.7	45.124.84.110
Jul 20, 2024 02:24:37.076350927 CEST	49931	15473	192.168.2.7	45.124.84.110
Jul 20, 2024 02:24:37.081259012 CEST	15473	49931	45.124.84.110	192.168.2.7
Jul 20, 2024 02:24:37.900212049 CEST	15397	49936	45.89.19.85	192.168.2.7
Jul 20, 2024 02:24:37.900346994 CEST	49936	15397	192.168.2.7	45.89.19.85
Jul 20, 2024 02:24:37.900563002 CEST	49936	15397	192.168.2.7	45.89.19.85
Jul 20, 2024 02:24:37.906065941 CEST	15397	49936	45.89.19.85	192.168.2.7
Jul 20, 2024 02:24:38.038230896 CEST	5678	49937	181.28.137.18	192.168.2.7
Jul 20, 2024 02:24:38.038403988 CEST	49937	5678	192.168.2.7	181.28.137.18
Jul 20, 2024 02:24:38.038640976 CEST	49937	5678	192.168.2.7	181.28.137.18
Jul 20, 2024 02:24:38.040213108 CEST	8088	49938	5.188.66.181	192.168.2.7
Jul 20, 2024 02:24:38.040270090 CEST	49938	8088	192.168.2.7	5.188.66.181
Jul 20, 2024 02:24:38.040452957 CEST	49938	8088	192.168.2.7	5.188.66.181
Jul 20, 2024 02:24:38.044375896 CEST	5678	49937	181.28.137.18	192.168.2.7
Jul 20, 2024 02:24:38.047171116 CEST	8088	49938	5.188.66.181	192.168.2.7
Jul 20, 2024 02:24:38.825829029 CEST	36476	49941	1.179.148.9	192.168.2.7
Jul 20, 2024 02:24:38.825975895 CEST	49941	36476	192.168.2.7	1.179.148.9
Jul 20, 2024 02:24:38.826105118 CEST	49941	36476	192.168.2.7	1.179.148.9
Jul 20, 2024 02:24:38.831012964 CEST	36476	49941	1.179.148.9	192.168.2.7
Jul 20, 2024 02:24:38.899844885 CEST	5678	49942	103.36.35.251	192.168.2.7
Jul 20, 2024 02:24:38.899949074 CEST	49942	5678	192.168.2.7	103.36.35.251
Jul 20, 2024 02:24:38.900089979 CEST	49942	5678	192.168.2.7	103.36.35.251
Jul 20, 2024 02:24:38.905008078 CEST	5678	49942	103.36.35.251	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2024 02:24:04.317060947 CEST	56499	53	192.168.2.7	1.1.1.1
Jul 20, 2024 02:24:04.324913979 CEST	53	56499	1.1.1.1	192.168.2.7
Jul 20, 2024 02:24:20.089457989 CEST	52463	53	192.168.2.7	1.1.1.1
Jul 20, 2024 02:24:20.096715927 CEST	53	52463	1.1.1.1	192.168.2.7
Jul 20, 2024 02:24:21.054140091 CEST	64476	53	192.168.2.7	1.1.1.1
Jul 20, 2024 02:24:21.060986996 CEST	53	64476	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 20, 2024 02:24:04.317060947 CEST	192.168.2.7	1.1.1.1	0xb039	Standard query (0)	api.proxyscrape.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 02:24:20.089457989 CEST	192.168.2.7	1.1.1.1	0x12a2	Standard query (0)	tools.keycdn.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 02:24:21.054140091 CEST	192.168.2.7	1.1.1.1	0x1897	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 20, 2024 02:24:04.324913979 CEST	1.1.1.1	192.168.2.7	0xb039	No error (0)	api.proxyscrape.com	104.18.11.5	A (IP address)	IN (0x0001)	false
Jul 20, 2024 02:24:04.324913979 CEST	1.1.1.1	192.168.2.7	0xb039	No error (0)	api.proxyscrape.com	104.18.10.5	A (IP address)	IN (0x0001)	false
Jul 20, 2024 02:24:20.096715927 CEST	1.1.1.1	192.168.2.7	0x12a2	No error (0)	tools.keycdn.com	185.172.148.96	A (IP address)	IN (0x0001)	false
Jul 20, 2024 02:24:21.060986996 CEST	1.1.1.1	192.168.2.7	0x1897	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 20, 2024 02:24:21.060986996 CEST	1.1.1.1	192.168.2.7	0x1897	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 20, 2024 02:24:21.060986996 CEST	1.1.1.1	192.168.2.7	0x1897	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.proxyscrape.com

tools.keycdn.com

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49736	47.122.60.157	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:05.426139116 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:08.324223042 CEST	8	IN	Data Raw: 00 5a 01 bb 01 01 01 01 Data Ascii: Z
Jul 20, 2024 02:24:08.349411964 CEST	6	OUT	Data Raw: 74 65 73 74 Data Ascii: test

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49761	189.175.197.223	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:05.468230009 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49766	93.158.155.18	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:05.476340055 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49767	189.226.237.127	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:05.478847027 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49812	47.254.36.213	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:06.192965984 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:08.711230040 CEST	8	IN	Data Raw: 00 5a 01 bb 01 01 01 01 Data Ascii: Z
Jul 20, 2024 02:24:08.711364985 CEST	6	OUT	Data Raw: 74 65 73 74 Data Ascii: test

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49817	47.104.28.135	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:06.735901117 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:09.616580009 CEST	8	IN	Data Raw: 00 5a 01 bb 01 01 01 01 Data Ascii: Z
Jul 20, 2024 02:24:09.616669893 CEST	6	OUT	Data Raw: 74 65 73 74 Data Ascii: test

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49831	47.251.87.199	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:07.079871893 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:09.579158068 CEST	8	IN	Data Raw: 00 5a 01 bb 01 01 01 01 Data Ascii: Z
Jul 20, 2024 02:24:09.579257965 CEST	6	OUT	Data Raw: 74 65 73 74 Data Ascii: test

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49834	47.238.128.246	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:07.083117008 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:09.917124033 CEST	8	IN	Data Raw: 00 5a 01 bb 01 01 01 01 Data Ascii: Z
Jul 20, 2024 02:24:09.917354107 CEST	6	OUT	Data Raw: 74 65 73 74 Data Ascii: test

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49847	142.138.80.36	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:07.844338894 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49872	178.20.45.29	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:08.547344923 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:18.268722057 CEST	8	IN	Data Raw: 00 5a 00 00 00 00 00 00 Data Ascii: Z
Jul 20, 2024 02:24:18.268851995 CEST	6	OUT	Data Raw: 74 65 73 74 Data Ascii: test

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49866	51.159.152.12	10709	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:09.059127092 CEST	207	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49882	170.106.76.24	23988	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:09.812477112 CEST	130	IN	HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8Proxy-Authenticate: Basic realm=""errorMsg: Unsupported protoco Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49893	104.24.69.32	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:09.860651016 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:10.306417942 CEST	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Sat, 20 Jul 2024 00:24:10 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49910	103.152.112.234	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:10.735198975 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49934	119.59.101.111	80	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 02:24:16.437880993 CEST	9	OUT	Data Raw: 04 01 01 bb 01 01 01 01 00 Data Ascii:
Jul 20, 2024 02:24:17.446307898 CEST	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 20 Jul 2024 00:24:17 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	104.18.11.5	443	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 00:24:05 UTC	159	OUT	GET /v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all HTTP/1.1 Host: api.proxyscrape.com Connection: Keep-Alive
2024-07-20 00:24:05 UTC	350	IN	HTTP/1.1 200 OK Date: Sat, 20 Jul 2024 00:24:05 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-store CF-Cache-Status: HIT Age: 21 Last-Modified: Sat, 20 Jul 2024 00:23:44 GMT Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8a5ece686adb0fa8-EWR
2024-07-20 00:24:05 UTC	1019	IN	Data Raw: 31 33 33 36 0d 0a 32 33 2e 31 30 35 2e 31 37 30 2e 33 33 3a 33 38 39 33 30 0d 0a 35 31 2e 38 31 2e 33 31 2e 36 34 3a 31 35 30 36 32 0d 0a 31 30 39 2e 31 32 30 2e 32 32 32 2e 39 30 3a 31 30 38 30 0d 0a 31 37 33 2e 32 31 32 2e 32 30 35 2e 31 34 34 3a 36 32 39 30 39 0d 0a 31 31 35 2e 37 33 2e 31 33 30 2e 31 32 32 3a 32 34 30 39 33 0d 0a 31 39 38 2e 38 2e 39 34 2e 31 37 34 3a 33 39 30 37 38 0d 0a 31 39 39 2e 31 31 36 2e 31 31 34 2e 31 31 3a 34 31 34 35 0d 0a 31 39 35 2e 31 35 34 2e 34 33 2e 31 39 38 3a 31 35 37 32 32 0d 0a 39 38 2e 31 30 33 2e 38 38 2e 31 35 38 3a 34 36 31 30 34 0d 0a 31 37 37 2e 38 35 2e 31 35 37 2e 32 35 3a 34 31 35 33 0d 0a 31 37 37 2e 31 30 34 2e 38 37 2e 32 33 3a 35 36 37 38 0d 0a 31 38 34 2e 31 38 31 2e 32 31 37 2e 32 31 33 3a 34 31 34 Data Ascii: 133623.105.170.33:3893051.81.31.64:15062109.120.222.90:1080173.212.205.144:62909115.73.130.122:24093198.8.94.174:39078199.116.114.11:4145195.154.43.198:1572298.103.88.158:46104177.85.157.25:4153177.104.87.23:5678184.181.217.213:414
2024-07-20 00:24:05 UTC	1369	IN	Data Raw: 0a 39 34 2e 32 33 2e 32 32 30 2e 31 33 36 3a 35 39 34 31 35 0d 0a 31 30 34 2e 32 33 39 2e 38 30 2e 31 32 34 3a 35 37 30 0d 0a 36 34 2e 31 32 34 2e 31 39 31 2e 39 38 3a 33 32 36 38 38 0d 0a 34 37 2e 32 35 34 2e 33 36 2e 32 31 33 3a 33 31 32 38 0d 0a 35 2e 32 32 2e 31 35 34 2e 35 30 3a 36 30 36 30 36 0d 0a 37 34 2e 31 31 39 2e 31 34 37 2e 32 30 39 3a 34 31 34 35 0d 0a 31 39 32 2e 31 31 31 2e 31 33 37 2e 33 34 3a 31 38 37 36 35 0d 0a 37 30 2e 31 36 36 2e 31 36 37 2e 33 38 3a 35 37 37 32 38 0d 0a 31 34 2e 32 32 35 2e 36 32 2e 37 36 3a 36 36 36 36 0d 0a 31 30 34 2e 32 33 38 2e 31 30 30 2e 31 31 35 3a 34 35 33 31 34 0d 0a 37 32 2e 31 30 2e 31 36 30 2e 31 37 32 3a 32 30 36 37 39 0d 0a 36 36 2e 32 33 2e 32 33 33 2e 32 31 30 3a 36 32 39 37 39 0d 0a 31 38 39 2e 31 Data Ascii: 94.23.220.136:59415104.239.80.124:57064.124.191.98:3268847.254.36.213:31285.22.154.50:6060674.119.147.209:4145192.111.137.34:1876570.166.167.38:5772814.225.62.76:6666104.238.100.115:4531472.10.160.172:2067966.23.233.210:62979189.1
2024-07-20 00:24:05 UTC	1369	IN	Data Raw: 2e 31 39 35 2e 31 37 33 3a 38 30 38 30 0d 0a 34 37 2e 31 30 34 2e 32 38 2e 31 33 35 3a 38 30 0d 0a 31 30 37 2e 31 38 30 2e 38 38 2e 31 37 33 3a 36 34 35 33 0d 0a 39 32 2e 32 30 35 2e 31 30 38 2e 39 34 3a 34 30 39 39 34 0d 0a 38 2e 31 33 30 2e 33 39 2e 31 31 37 3a 39 30 39 30 0d 0a 31 37 37 2e 33 38 2e 32 34 35 2e 31 30 36 3a 35 35 37 31 33 0d 0a 31 39 32 2e 31 31 31 2e 31 33 37 2e 33 35 3a 34 31 34 35 0d 0a 31 37 37 2e 31 32 36 2e 38 36 2e 37 38 3a 34 31 34 35 0d 0a 31 39 30 2e 39 36 2e 39 37 2e 32 30 32 3a 34 31 35 33 0d 0a 31 39 33 2e 31 34 33 2e 31 2e 32 30 31 3a 34 34 34 34 0d 0a 34 35 2e 32 33 34 2e 31 30 30 2e 31 30 32 3a 31 30 38 30 0d 0a 37 30 2e 31 36 36 2e 31 36 37 2e 35 35 3a 35 37 37 34 35 0d 0a 38 35 2e 32 30 36 2e 31 36 37 2e 31 33 33 3a 33 Data Ascii: .195.173:808047.104.28.135:80107.180.88.173:645392.205.108.94:409948.130.39.117:9090177.38.245.106:55713192.111.137.35:4145177.126.86.78:4145190.96.97.202:4153193.143.1.201:444445.234.100.102:108070.166.167.55:5774585.206.167.133:3
2024-07-20 00:24:05 UTC	1169	IN	Data Raw: 37 32 2e 31 30 2e 31 36 30 2e 31 37 32 3a 31 33 36 39 37 0d 0a 31 37 30 2e 32 34 34 2e 36 34 2e 31 32 3a 33 31 34 37 36 0d 0a 31 36 32 2e 32 31 34 2e 31 36 32 2e 31 35 36 3a 34 35 37 36 34 0d 0a 31 33 38 2e 32 35 35 2e 32 34 30 2e 36 36 3a 34 30 37 33 36 0d 0a 31 30 34 2e 33 37 2e 31 33 35 2e 31 34 35 3a 34 31 34 35 0d 0a 31 39 32 2e 32 35 32 2e 32 30 38 2e 36 37 3a 31 34 32 38 37 0d 0a 34 36 2e 32 31 39 2e 31 2e 35 3a 35 36 37 38 0d 0a 31 38 34 2e 31 36 38 2e 31 32 31 2e 31 35 33 3a 32 33 30 38 37 0d 0a 31 2e 31 37 39 2e 31 35 31 2e 31 36 35 3a 33 31 39 34 38 0d 0a 37 37 2e 36 35 2e 35 30 2e 31 31 38 3a 33 34 31 35 39 0d 0a 31 30 34 2e 32 34 2e 36 39 2e 33 32 3a 38 30 0d 0a 31 31 35 2e 38 35 2e 38 36 2e 31 31 34 3a 35 36 37 38 0d 0a 35 30 2e 36 33 2e 31 Data Ascii: 72.10.160.172:13697170.244.64.12:31476162.214.162.156:45764138.255.240.66:40736104.37.135.145:4145192.252.208.67:1428746.219.1.5:5678184.168.121.153:230871.179.151.165:3194877.65.50.118:34159104.24.69.32:80115.85.86.114:567850.63.1
2024-07-20 00:24:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49947	185.172.148.96	443	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 00:24:20 UTC	166	OUT	GET /geo.json HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: tools.keycdn.com Connection: Keep-Alive
2024-07-20 00:24:21 UTC	150	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sat, 20 Jul 2024 00:24:20 GMT Content-Type: application/json Content-Length: 119 Connection: close
2024-07-20 00:24:21 UTC	119	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 73 65 72 2d 41 67 65 6e 74 20 6e 6f 74 20 70 72 6f 70 65 72 6c 79 20 64 65 66 69 6e 65 64 2e 20 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 65 20 64 6f 63 73 3a 20 68 74 74 70 73 3a 2f 2f 74 6f 6f 6c 73 2e 6b 65 79 63 64 6e 2e 63 6f 6d 2f 67 65 6f 22 7d Data Ascii: {"status":"error","description":"User-Agent not properly defined. Please check the docs: https://tools.keycdn.com/geo"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49948	104.26.13.205	443	5452	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 00:24:21 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-20 00:24:21 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 20 Jul 2024 00:24:21 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a5ececf390a42ac-EWR
2024-07-20 00:24:21 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	20:23:58
Start date:	19/07/2024
Path:	C:\Users\user\Desktop\kz7iLmqRuq.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\kz7iLmqRuq.exe"
Imagebase:	0xfa0000
File size:	3'033'088 bytes
MD5 hash:	4EBD63449193B8FDBD0C0315F8E33E10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1234830899.0000000000FA2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1262889498.000000001BFE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:24:01
Start date:	19/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f
Imagebase:	0x7ff682ca0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:24:01
Start date:	19/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:24:01
Start date:	19/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\Desktop\kz7iLmqRuq.exe" /rl HIGHEST /f
Imagebase:	0x7ff682ca0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:24:01
Start date:	19/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:24:01
Start date:	19/07/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"
Imagebase:	0xa40000
File size:	3'033'088 bytes
MD5 hash:	4EBD63449193B8FDBD0C0315F8E33E10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Author: ditekshen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 76%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:24:01
Start date:	19/07/2024
Path:	C:\Users\user\Desktop\kz7iLmqRuq.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\kz7iLmqRuq.exe
Imagebase:	0x4b0000
File size:	3'033'088 bytes
MD5 hash:	4EBD63449193B8FDBD0C0315F8E33E10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:24:02
Start date:	19/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f
Imagebase:	0x7ff682ca0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:24:02
Start date:	19/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:24:02
Start date:	19/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" /rl HIGHEST /f
Imagebase:	0x7ff682ca0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:24:02
Start date:	19/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAACCB34E5 Relevance: 1.7, APIs: 1, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFAACCB35C7

Memory Dump Source

Source File: 00000000.00000002.1263868846.00007FFAACCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccb0000_kz7iLmqRuq.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8e0708a864bfc10da7628ab4d6f480a4dbf42f06daf1c73784cd5909b4290a3e
Instruction ID: 64c96139499ec369f489f289fe72607af9692ffd5ee72e75d5361bc92ca4583e
Opcode Fuzzy Hash: 8e0708a864bfc10da7628ab4d6f480a4dbf42f06daf1c73784cd5909b4290a3e
Instruction Fuzzy Hash: DE41267180DB4C8FEB19DFAC98456F9BFF0EF56310F0882ABD04DC7592DA24A8498791

Function 00007FFAACCB3529 Relevance: 1.6, APIs: 1, Instructions: 112
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFAACCB35C7

Memory Dump Source

Source File: 00000000.00000002.1263868846.00007FFAACCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccb0000_kz7iLmqRuq.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 70ab804a6c5a538f0d0d94d14edaedef0d86b0f392777054e400406c7e47a35b
Instruction ID: 18c497342fc62f77d8919aea9c158504aba350935bd97e689280b1524b525639
Opcode Fuzzy Hash: 70ab804a6c5a538f0d0d94d14edaedef0d86b0f392777054e400406c7e47a35b
Instruction Fuzzy Hash: 5731E27180CB5C8FDB19DF588849AF9BBF0FF56310F04826BD049D3192DB74A8098B81

Analysis Process: svchost.exePID: 5452, Parent PID: 4508COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAAD041501 Relevance: 7.4, Strings: 1, Instructions: 6160COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFAAD043767

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 26acf29bda569ff591545f9b2534458c7e6bf3e434e5bc8937a473819b3c1b14
Instruction ID: 7b71153a1bb52d1bcd596bddc020cee2f6ab3e76fb5ca7d60b44f1bd09d4b2f7
Opcode Fuzzy Hash: 26acf29bda569ff591545f9b2534458c7e6bf3e434e5bc8937a473819b3c1b14
Instruction Fuzzy Hash: C9732995F19E4A8FFBA6932C44167395AC2EFDA210794817AD06FC32D6FD28DC1A43C1

Function 00007FFAACCD93E8 Relevance: 4.7, Strings: 2, Instructions: 2216COMMON

Download Yara Rule

Strings

0X%, xrefs: 00007FFAACD04662
0#%, xrefs: 00007FFAACD04937

Memory Dump Source

Source File: 00000006.00000002.3720324549.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccd0000_svchost.jbxd

Similarity

API ID:
String ID: 0#%$0X%
API String ID: 0-758952704
Opcode ID: 575be9aef5f4d64d61f6284423707aee3d79ca9ae215e6742e85e62ee348025d
Instruction ID: 2eef277c0b1fc37c4a4b7b9652699a3f9712afb243d52123edb593b136545446
Opcode Fuzzy Hash: 575be9aef5f4d64d61f6284423707aee3d79ca9ae215e6742e85e62ee348025d
Instruction Fuzzy Hash: 58F27370A18A098FEB98EF1CC495BA97BE1FF59304F1081A9D05ED7296DF34E945CB80

Function 00007FFAACFA1CBA Relevance: 4.6, Strings: 3, Instructions: 887
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0W%, xrefs: 00007FFAACFA23E9
0W%, xrefs: 00007FFAACFA238D
0W%, xrefs: 00007FFAACFA2354

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID: 0W%$0W%$0W%
API String ID: 0-3261867109
Opcode ID: e7bd32026ab67c260507166feb91dd27ae4cba8dcee5004e05fdc04c14445e62
Instruction ID: b86ff2916c7156e477819273d08c2a95a25524d22bf18d7fc34b1ecbcc83b4f7
Opcode Fuzzy Hash: e7bd32026ab67c260507166feb91dd27ae4cba8dcee5004e05fdc04c14445e62
Instruction Fuzzy Hash: E852E371B18B4A8FEB98DB2884456B9B3E1FF99700F548579D44EC3682DF28F84687C1

Function 00007FFAACF909D1 Relevance: 4.0, Strings: 2, Instructions: 1507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(L%, xrefs: 00007FFAACF90D3C
`%%, xrefs: 00007FFAACF90C9F

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID: (L%$`%%
API String ID: 0-2764772831
Opcode ID: e3af5c35300e454e5dab82eb246599d187b7f9fc9e642ffd8aa40aec91fc11c7
Instruction ID: c9ce376656b44f09c687ca26a068b64b6df524246931a3a63cd4aa7530c4b6e7
Opcode Fuzzy Hash: e3af5c35300e454e5dab82eb246599d187b7f9fc9e642ffd8aa40aec91fc11c7
Instruction Fuzzy Hash: 6892E871719A098FEB98EB3CC455B7977D1EF99310F0480BAE44EC7292DE29EC468781

Function 00007FFAACFAF273 Relevance: 3.1, Strings: 2, Instructions: 598
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`%%, xrefs: 00007FFAACFAF2C8
1*_H, xrefs: 00007FFAACFAF2D2

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID: 1*_H$`%%
API String ID: 0-3097783499
Opcode ID: 5da3ea70bfd3487c727d5ab46e363e553fd9e0e94f780bfab36a29f971abb82d
Instruction ID: 52beaf52ac8f17cae572526c82ff4c73c3a33b382c5871dd02670efc966157f0
Opcode Fuzzy Hash: 5da3ea70bfd3487c727d5ab46e363e553fd9e0e94f780bfab36a29f971abb82d
Instruction Fuzzy Hash: 50023371619A498FEB88EF2CC456EA9B7E2EF99740F504179E40DC7296CE34EC4687C0

Function 00007FFAACFA2F25 Relevance: 2.4, Strings: 1, Instructions: 1140COMMON

Download Yara Rule

Strings

p]%, xrefs: 00007FFAACFA332B

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID: p]%
API String ID: 0-641334170
Opcode ID: 7c42f042489e56c12a15a7e26c650c673cdd7938a6fa60bdb30f56ea1a2be381
Instruction ID: 90c0cbbc2bdeab335c75340b2ce5446576f602b740a0335980ac4273653e69be
Opcode Fuzzy Hash: 7c42f042489e56c12a15a7e26c650c673cdd7938a6fa60bdb30f56ea1a2be381
Instruction Fuzzy Hash: D97229A191EB868FF7A5973C84166B8BBE0EF56720B0441F9D84DC7593DE1CE80E8391

Function 00007FFAACF91DDD Relevance: .8, Instructions: 821COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539f522ac5ec338628a60f6a5defcb1bae9d1ff83e163789aed531473da1bb67
Instruction ID: 6a68913f56b208da7f9bc1c305f0868c4fda2468f79ef0df7203789dc60bac44
Opcode Fuzzy Hash: 539f522ac5ec338628a60f6a5defcb1bae9d1ff83e163789aed531473da1bb67
Instruction Fuzzy Hash: 6D425F70608A498FEB98EB2CC455B7977E1FF99300F1485B9E44EC72A2DE39E8458B41

Function 00007FFAACF9000A Relevance: .8, Instructions: 767COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86fe4e2956b40a232cb065e1f24cdb85333d4bc54bf826a4f95342e01e5d60f0
Instruction ID: f454d1be61c269764343879f1dda0278192ffee8e90c0bd5025c835e0c53d028
Opcode Fuzzy Hash: 86fe4e2956b40a232cb065e1f24cdb85333d4bc54bf826a4f95342e01e5d60f0
Instruction Fuzzy Hash: 6B329130A0DB098FEB98DB6884557B977E1FF9A300F1481BDD44EC3292DE29E8468791

Function 00007FFAACF91F0B Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9009ce5414841dac97a84e3f4f12809d0aa03cf6eeee24942c9c74c40dd290cc
Instruction ID: 34a36348825186788c816ef1973495d6b48874cae8abac44f219869590e1bbb9
Opcode Fuzzy Hash: 9009ce5414841dac97a84e3f4f12809d0aa03cf6eeee24942c9c74c40dd290cc
Instruction Fuzzy Hash: 65120270718A098FEB98EB2CC454B6977E1FF99300F5485B9E44EC72A2DF39E8458B41

Function 00007FFAACF9DC96 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e3aa314882d44e100f4a343ee9d22aeae44b82d1a900ababa01d7c26cd3760
Instruction ID: a39e2d7aba42ff4df5441fcef6b6662985a2c63b5e3f9229d2b87ae88c1d6a83
Opcode Fuzzy Hash: a1e3aa314882d44e100f4a343ee9d22aeae44b82d1a900ababa01d7c26cd3760
Instruction Fuzzy Hash: 89F1A270509B8D8FEBA8DF28C8457E93BE1FF55310F14826AE84EC7295CB39D9458B81

Function 00007FFAACF9EA42 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebb8d195656b81422ca014bfd588746b50245b420752ff65b8fb44fff16ccb4
Instruction ID: 1afbc9c27ecd7da894b4c6409f37659b553ed707db815e026ad43d54bfe36408
Opcode Fuzzy Hash: bebb8d195656b81422ca014bfd588746b50245b420752ff65b8fb44fff16ccb4
Instruction Fuzzy Hash: B1E1D270509A4E8FEBA8DF28C8557E977E1EF55310F04826EE85EC7295CF39E8448B81

Function 00007FFAACFB4935 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a119c4eec66d60cf499bf3e0275a39c8ead6eb66d898c674126eddbbbb62877a
Instruction ID: 996f9e172824fd4d236db6bf3c1a6ba5571738d9d66cfc827278fcd824e1ec1e
Opcode Fuzzy Hash: a119c4eec66d60cf499bf3e0275a39c8ead6eb66d898c674126eddbbbb62877a
Instruction Fuzzy Hash: 66029F70A0978A8FEB85DF28C4647A97BA1FF4A304F1485B9D45DC7283CF35A816CB94

Function 00007FFAACF95958 Relevance: 1.7, APIs: 1, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bca9e9832c5462b270a96fa0a0d04f50a0a372dbc4f534aa586e6c39ed5b328
Instruction ID: b0df69de5bd7d134b4f3075a6600f783f29ec9aa72ebae5c315875f1919769d6
Opcode Fuzzy Hash: 6bca9e9832c5462b270a96fa0a0d04f50a0a372dbc4f534aa586e6c39ed5b328
Instruction Fuzzy Hash: 2751C471A1CB598FEB58EB6C94466F977E0EF59710F0042BEE00EC3282DE25A85687C1

Function 00007FFAACCD34E5 Relevance: 1.7, APIs: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00007FFAACCD35C7

Memory Dump Source

Source File: 00000006.00000002.3720324549.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccd0000_svchost.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0729f605a670368ac5bf7af5efc98d7afb2e263c20e757be8a3da416a1e1d311
Instruction ID: 7909387e8a240f0011200c3e42abf75f944a680c397e62f7751f381457c08482
Opcode Fuzzy Hash: 0729f605a670368ac5bf7af5efc98d7afb2e263c20e757be8a3da416a1e1d311
Instruction Fuzzy Hash: FF41367180DB8C8FEB06DF6C98456F97FF0EF56320F0882ABD00DC7592DA24A8198781

Function 00007FFAACCD3529 Relevance: 1.6, APIs: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00007FFAACCD35C7

Memory Dump Source

Source File: 00000006.00000002.3720324549.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccd0000_svchost.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3945c99d75b137fd428b58797818f0085b320484851786e3289c7acab85709b5
Instruction ID: 9f2f9d98a225eb863f0242f942cbc612530a3f33f4563cb99ab76d1d2028f49b
Opcode Fuzzy Hash: 3945c99d75b137fd428b58797818f0085b320484851786e3289c7acab85709b5
Instruction Fuzzy Hash: 4331E27180CB4C8FDB19DF688849AF9BBF0FF66310F04826BD049D3592DB74A8198B81

Function 00007FFAACCD1FF2 Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00007FFAACCD35C7

Memory Dump Source

Source File: 00000006.00000002.3720324549.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccd0000_svchost.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8f1eb3e06bf07d4431dacf44d8c488a24e3b928a49bdcb22deca5669404a8462
Instruction ID: ed696ac535baa20591ab76ce6f6083c13ff63b92bc4e4e70323dff2b8f037025
Opcode Fuzzy Hash: 8f1eb3e06bf07d4431dacf44d8c488a24e3b928a49bdcb22deca5669404a8462
Instruction Fuzzy Hash: 70319A71908A1C9FDB58DFA8C449AF9BBE0FF65321F04822FD04AD3651DB74A8168B81

Function 00007FFAAD04125D Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf65eec7533af7b29388c358e8fc2c8ce8a880370044e064e5e79ea11be09395
Instruction ID: 5d2247636e71a7780b8cc87409d06e907f71ce525b701721174e3059b7b101f9
Opcode Fuzzy Hash: bf65eec7533af7b29388c358e8fc2c8ce8a880370044e064e5e79ea11be09395
Instruction Fuzzy Hash: 2381C210B2EE578FF686976C84A677966D2EF9A300F54807AD04DC76C7DE28EC1943C2

Function 00007FFAACBBED54 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3719932976.00007FFAACBBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACBBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacbbd000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7435d005551cac7177d3827c11a203da4062c5d16da1b2d88c06b55535d0c94f
Instruction ID: 283d29fe5051ab2cc371406c49dc6da50706217978e7740839d306ed13a8767c
Opcode Fuzzy Hash: 7435d005551cac7177d3827c11a203da4062c5d16da1b2d88c06b55535d0c94f
Instruction Fuzzy Hash: DB41D07140EBC48FE35A9B28C8458523FE0EF57360B1845EFD08CCB1A3D665E84AC792

Function 00007FFAAD043DB3 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3eb035e6f144fbc7f9963d1d300b29ceadbc3a2388bfb13ca5a2cfad22b030
Instruction ID: 3da56ea5e75024bd25e3afda697cc3088e9590b510d842348e21007c0f4022e4
Opcode Fuzzy Hash: ea3eb035e6f144fbc7f9963d1d300b29ceadbc3a2388bfb13ca5a2cfad22b030
Instruction Fuzzy Hash: 04212891B1AE4A8FF7E6A32C54567345AC2DF9921079940BAD05FC32DAFD28DC4A43C0

Function 00007FFAAD0439D6 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b53beae5333447edfaebadc541fbfc902a6528bd470c35ed5b9d6c6cc8f6f1f
Instruction ID: 59d95a878a36cff382a5e0cb44bf9bd2dcb9cb968954002fa1ee47effc103e1a
Opcode Fuzzy Hash: 2b53beae5333447edfaebadc541fbfc902a6528bd470c35ed5b9d6c6cc8f6f1f
Instruction Fuzzy Hash: C9213A91B2AE4A8FF7A6A32C44557785AC2DF9911079941BAD09FC339AFD28DC1643C0

Function 00007FFAAD042C6A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902eac4953d2aa79d1a03686a0cd1182d912715ba5d198678e8d1338199bf332
Instruction ID: 65221ea4b962571fdcd5bf97772f6e4daed4da8b572c6cae981a22b80b67494e
Opcode Fuzzy Hash: 902eac4953d2aa79d1a03686a0cd1182d912715ba5d198678e8d1338199bf332
Instruction Fuzzy Hash: 94212591B1AE0A8FF6A6A33C485577859C2EFD92107A981BAD05FC33D6FD28DC4643C0

Function 00007FFAAD04215E Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb8be3ff210caa9defda3bcd396af197d3e4f66d71fe77ae52529089787968a
Instruction ID: 8709fe1614518cb128f92a97d46e742a851eb866c12f0ed22e4efc441356ffd5
Opcode Fuzzy Hash: 3bb8be3ff210caa9defda3bcd396af197d3e4f66d71fe77ae52529089787968a
Instruction Fuzzy Hash: 362106A1B0AE0A8FF7A6A33C4455B7456C2EF9921079984BAD49FC3396FD28DC0643C0

Function 00007FFAAD0426E5 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae2ad92c154c9c290811ae51fb2413c20eec50fd34cc58f650673e95c2a8992
Instruction ID: 288bae4acbc17d9a925a8044df468c6bd4c4a728804e0ace9ab0ea7abc2e3934
Opcode Fuzzy Hash: 9ae2ad92c154c9c290811ae51fb2413c20eec50fd34cc58f650673e95c2a8992
Instruction Fuzzy Hash: 55212B95B19E0A8FF796A33C445573855C2EFD911079980BAD05FC339AFD28DC5543C1

Function 00007FFAAD042943 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae1a201a720a55063c34fdba8ed72996a8957923814da2aa334e484836ba4a5
Instruction ID: dba117f8dc481bbf7e635e2eca648d43564dc91a301a52b6e9b5e9bbb6a5e7ea
Opcode Fuzzy Hash: cae1a201a720a55063c34fdba8ed72996a8957923814da2aa334e484836ba4a5
Instruction Fuzzy Hash: 36212891B19E0A8FF6A6A33C445577855C2EFCA21079944BAD05FC339AFE68DC1643C1

Function 00007FFAAD041FD3 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737513e2bb41d5fbd9ce1a2a3583ea57adaecf603665f3bee4592ba96d9cb1d7
Instruction ID: 24d1e20df0c2c533c0e0c0ca9b53a7edf60d59f98aec53df121e6d1c5039967d
Opcode Fuzzy Hash: 737513e2bb41d5fbd9ce1a2a3583ea57adaecf603665f3bee4592ba96d9cb1d7
Instruction Fuzzy Hash: 7B210A95B09E4ACFF796A33C445577859C2EF9921079940BAD05FC32D6FD28DC5643C0

Function 00007FFAAD0436B5 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beca91ea4e22fc5759cad5d32e009e052a17b8e91f7eb70a99f05a2202c3d859
Instruction ID: fdb4f71d1fcf29bef7658a9858838eed38bc8f3b8252a586c50c18717cd1878b
Opcode Fuzzy Hash: beca91ea4e22fc5759cad5d32e009e052a17b8e91f7eb70a99f05a2202c3d859
Instruction Fuzzy Hash: 20210A91B1AE0A8BF6A6A32C44157395AC2EFD921079980BAD05FC3396FD28DC1643C0

Function 00007FFAAD043C3B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8526db8f63bfd4ce123f805be188aee9059f7e44a123d59b956660a632b5f016
Instruction ID: c4744b0fd622c5c64aa5955b511e85f541eb78cb3c66f6e86a3eb00c98b0f5e4
Opcode Fuzzy Hash: 8526db8f63bfd4ce123f805be188aee9059f7e44a123d59b956660a632b5f016
Instruction Fuzzy Hash: 3121C8A1B19E0A8BF796A32C445577455C2DF9921079951BAD05FC3296FD28DC1643C0

Function 00007FFAAD044A67 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5213ea6076918cde459282f3a956f15477dcd802b5aae49fd2dccd98dbaf94b7
Instruction ID: c30e4e563da5748d81f2af14084e9d04e387b7d23ce26866415701fb180e0f69
Opcode Fuzzy Hash: 5213ea6076918cde459282f3a956f15477dcd802b5aae49fd2dccd98dbaf94b7
Instruction Fuzzy Hash: AA213791B1AE4A8FF796A32C445577855C2EF9A2107A981BAC05FC33D6FD68DC1A43C0

Function 00007FFAAD043AA5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08238923c4b222d206b19f729b52bdf3fbebbea0f2aeadbe254aaab14546517f
Instruction ID: 3153228d485564bba425b18b2a0721c120dadb506c1c63deb59d52b7325c885d
Opcode Fuzzy Hash: 08238923c4b222d206b19f729b52bdf3fbebbea0f2aeadbe254aaab14546517f
Instruction Fuzzy Hash: C3214991B1EE4A8FF7A6A32C441177459C2EF8A21079840BAC05FC32D6FD28DC1543C0

Function 00007FFAAD041FB6 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d332db14f6e303524b1db84b72d9771ae5dff90eb08199fd69b86c283cf8a7
Instruction ID: 2506979700059bd54723e8260b93a308369538b26deb2f9a77d9bfabbe712023
Opcode Fuzzy Hash: 09d332db14f6e303524b1db84b72d9771ae5dff90eb08199fd69b86c283cf8a7
Instruction Fuzzy Hash: 47210B91B0DE4ACFF796A33C84557345AC2EF95210B9540BAD05FC3296FE28DC168380

Function 00007FFAAD042D63 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21aebaebe3183b88dcaa0fa467c3fd5b2b03ccaea4a9a5031da49dca4463eb12
Instruction ID: 1706783a3240f7524fc9ca3525c6ea706b5368f5e097086ac76a2e6fb149e259
Opcode Fuzzy Hash: 21aebaebe3183b88dcaa0fa467c3fd5b2b03ccaea4a9a5031da49dca4463eb12
Instruction Fuzzy Hash: 18112BA5B0AE4A8FF796A33C4415B7459C2EF8911079941BAD05FC32D6FD38DC554380

Function 00007FFAAD04257F Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac23158bc02ef7b20942fa42eadf8c1874e075b31e7737604b1b4c34ffbc4671
Instruction ID: ae39df56d63d0c5b577662c209e9e0a2663acc53c8107ec0423720a55783be01
Opcode Fuzzy Hash: ac23158bc02ef7b20942fa42eadf8c1874e075b31e7737604b1b4c34ffbc4671
Instruction Fuzzy Hash: 4C1108A5B0DE4A8FF796A33C4425B3499C2EF8922079941BAD45FC3296FD38D8564380

Function 00007FFAAD041A70 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c9dbcb52cc75a853e29c1375a4ad16275dc86bbfbce94fd9028c1416a3f3e8
Instruction ID: 2f220fd87379641b91edb316b1fffaedc71410c94a78a87e1c8fe330400ed11f
Opcode Fuzzy Hash: 48c9dbcb52cc75a853e29c1375a4ad16275dc86bbfbce94fd9028c1416a3f3e8
Instruction Fuzzy Hash: 851108A1B0AE4A8BF796A33C845577499C2EF962107A940B9D05FC32D6FE28DC194381

Function 00007FFAAD04308A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef508c9acee87d224b0a3a61beb18b033631deacc3f547a874aa3f428fcf7194
Instruction ID: fe3f3a3453475edb624f6a6a8dd87459e6df1ab8e1a8fb1242e1a68aa8c415c1
Opcode Fuzzy Hash: ef508c9acee87d224b0a3a61beb18b033631deacc3f547a874aa3f428fcf7194
Instruction Fuzzy Hash: 7B110D91B19E4A8FF7A6A33C4465B3899C2EF8511079941B9D05FC32D6FD68DC154381

Function 00007FFAAD043EBE Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e01d3706b35da1d981b8a6689213e3d0bcc791bbec9118c9dd0f0f4cd9d2052
Instruction ID: c43e233d140db97d97783352b9a5da894dcec446b863872ad49fc7e897a0cb23
Opcode Fuzzy Hash: 2e01d3706b35da1d981b8a6689213e3d0bcc791bbec9118c9dd0f0f4cd9d2052
Instruction Fuzzy Hash: D1112BA1B1AE4ACFF7A6A32C44557399AC2EF8521079940BAD05FC32D6FE28DC154380

Function 00007FFAAD041E68 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7787294783c3fecdcd96cbebf6269701563a55240af98c4f0fc8ac10fda8f9bf
Instruction ID: c44c86e94d445ba44390402cff51916dbea7da8b54b29c8b36336a389d8b6b0f
Opcode Fuzzy Hash: 7787294783c3fecdcd96cbebf6269701563a55240af98c4f0fc8ac10fda8f9bf
Instruction Fuzzy Hash: D4113D91B0EE4A8FF7A6A33C4455B7559C2DF9511079941B9C05FC32D6FD28DC154381

Function 00007FFAAD0400C1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723515295.00007FFAAD040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaad040000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234ffd611481daf22c0762d18be7df6385f34356e8811f85fcd1bb69d7afa5ff
Instruction ID: 3ad2ef55849333a9951b3a494f52eef61b7a638fa6e593486dae859163c79ba3
Opcode Fuzzy Hash: 234ffd611481daf22c0762d18be7df6385f34356e8811f85fcd1bb69d7afa5ff
Instruction Fuzzy Hash: 70D0C71175A52187F604168C7C463B57185DBD9714F504037D41DD22CAC89EACD543C2

Non-executed Functions

Function 00007FFAACCD9408 Relevance: 1.9, Strings: 1, Instructions: 655COMMON

Download Yara Rule

Strings

0X%, xrefs: 00007FFAACD02508

Memory Dump Source

Source File: 00000006.00000002.3720324549.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaaccd0000_svchost.jbxd

Similarity

API ID:
String ID: 0X%
API String ID: 0-3152437580
Opcode ID: 6d728b721e7e57c3d8d765209cb2d997bc53f73de38ef93e3f5f0181bb4e3530
Instruction ID: 58ab5a7ddb8e2369cbc73960e5b7d884de6773e7410cc63f6299cf182fa141f7
Opcode Fuzzy Hash: 6d728b721e7e57c3d8d765209cb2d997bc53f73de38ef93e3f5f0181bb4e3530
Instruction Fuzzy Hash: 46128C30A1DA498FE798EB2CD445975B7E1FF99310F10857DE49EC3296DE34E8428B81

Function 00007FFAACFB15C5 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a97bb3c5ded111c94d0f0e231405de48cd138f71dce182800ebf07f2f0517d0
Instruction ID: dbbe940784025418e656b29f6a85e46b50afd26f4a2c3b79b5a1f80ba93bde79
Opcode Fuzzy Hash: 4a97bb3c5ded111c94d0f0e231405de48cd138f71dce182800ebf07f2f0517d0
Instruction Fuzzy Hash: 2FD16F7071CA094FEB48EB3CD459A7573D2EF99310B0481B9E44EC72A6DE28EC428785

Function 00007FFAACFB0A61 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3723134037.00007FFAACF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffaacf90000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d108079e394df0ad978702a3572837a1f786ebbd2d14c50ea919d6c83eec18a
Instruction ID: a440a7ff70b58c34e1a32fa7cead76932403972719dd2edcfe66f2c621aad9ac
Opcode Fuzzy Hash: 7d108079e394df0ad978702a3572837a1f786ebbd2d14c50ea919d6c83eec18a
Instruction Fuzzy Hash: C5C16171718A088FE798EF2CC459B7977D2FF99301B1481BAE44EC72A2DE24EC468744

Analysis Process: kz7iLmqRuq.exePID: 4220, Parent PID: 932COMMON

Executed Functions

Function 00007FFAACCA0B78 Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

x.8, xrefs: 00007FFAACCA0B89
;P_I, xrefs: 00007FFAACCA0C04

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID: ;P_I$x.8
API String ID: 0-3184673829
Opcode ID: 9fc68545102845f97bf9a5c8736ac4cb84d6e2997bcee780c4df89b45e161780
Instruction ID: c11bddf50cd233aebddf03ae37d9f4f3db0b247038b259c602f9d74d19b26e72
Opcode Fuzzy Hash: 9fc68545102845f97bf9a5c8736ac4cb84d6e2997bcee780c4df89b45e161780
Instruction Fuzzy Hash: AAA12BA290E7819FF314DB6C945A6B57FA1EF46314B4480FAE08D872DBD928D909C3D3

Function 00007FFAACCA1FC8 Relevance: 1.7, Strings: 1, Instructions: 490COMMON

Download Yara Rule

Strings

0D%, xrefs: 00007FFAACCA23C6

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID: 0D%
API String ID: 0-2933537624
Opcode ID: f61f849efd8eeaaaa4c327e3f6b55d8fe060e5930717fb2a5d079d7eda4e3682
Instruction ID: 1b9599b61289b07c1918277fdcc0d503044d7338bfd536f865b0a1b284fbceb7
Opcode Fuzzy Hash: f61f849efd8eeaaaa4c327e3f6b55d8fe060e5930717fb2a5d079d7eda4e3682
Instruction Fuzzy Hash: D4C13AA2A0D99A8FF795EB3C84596F93BD2EF95710F0441B6D00DC7197DE28E84A83C1

Function 00007FFAACCA3451 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

8e%, xrefs: 00007FFAACCA3495

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID: 8e%
API String ID: 0-1390493536
Opcode ID: b59856b03e835cc83900d729ab2722e98ba469e238d915d7298c1fbcab2677ed
Instruction ID: 3df297532f99c0c925a652b1bc8807fb31025f08fb5310bcc911906cdc64fbf4
Opcode Fuzzy Hash: b59856b03e835cc83900d729ab2722e98ba469e238d915d7298c1fbcab2677ed
Instruction Fuzzy Hash: 60115721D1D7414FF306AB38989E4F2BFD1DF9222070885BBE44DC65A3CD1CE94A8391

Function 00007FFAACCA0889 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

`m%, xrefs: 00007FFAACCA090F

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID: `m%
API String ID: 0-1380665749
Opcode ID: 5f7938c58cc7f2c7c71646ad11aa79ece0ba9e42aa50de986a1995795320d9c6
Instruction ID: d4f119c57b8ded291270d9766d0b10b29d57606384e07b10aba87d8aed8cdb86
Opcode Fuzzy Hash: 5f7938c58cc7f2c7c71646ad11aa79ece0ba9e42aa50de986a1995795320d9c6
Instruction Fuzzy Hash: 941157D282DE468EF394AB78841AAB55791FF44780F4405F8C00FC72C7DC28A84943C5

Function 00007FFAACCA2D88 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3563ebc91128f36c4b9260cb0cc418e4b9049eec73fe64dcb0c05bc8c65840
Instruction ID: d18ade88ecc46f74ada3ec3c0b299023b31d34bed5afb163583308b7ef3a2055
Opcode Fuzzy Hash: 4f3563ebc91128f36c4b9260cb0cc418e4b9049eec73fe64dcb0c05bc8c65840
Instruction Fuzzy Hash: A2717161F189198FEB98EB6CC4597FDB7E2EF99710F444179D40ED3282DE28AC468780

Function 00007FFAACCA246E Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a1df8530d31dc7c0db870eee55323e22eacf3da3a0f180d11871c80d609735
Instruction ID: 787e738262e5551a7865b9cca2337a36064600ae948d52adaa674d10ad70b1a6
Opcode Fuzzy Hash: 96a1df8530d31dc7c0db870eee55323e22eacf3da3a0f180d11871c80d609735
Instruction Fuzzy Hash: 9B51E751B5DA568FFB86A77C80696BD6AE3EF8A610B8480F9D00DC71D7DD1CD806C382

Function 00007FFAACCA194D Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f786210b1745894b578fee820414be08a69e9f162a30825a77e7e4a86fc4eae3
Instruction ID: a6cb56a47147094b2e15f630dea7be66e678490e2c6e3e429613951e4c357e9a
Opcode Fuzzy Hash: f786210b1745894b578fee820414be08a69e9f162a30825a77e7e4a86fc4eae3
Instruction Fuzzy Hash: B921823150A586CFEB559F3884C95A57B92EF56320B1882F9D04CCF19BD529EC8AC381

Function 00007FFAACCA329D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e33025d0f8d2ead7ff9819e8677cdbd8af87310068a016dcfa35526764ddea7
Instruction ID: 27c007597d2ec3c5da701b173270be1727bc6d85ca1dccb99a4d3ba7f5bfe9c5
Opcode Fuzzy Hash: 9e33025d0f8d2ead7ff9819e8677cdbd8af87310068a016dcfa35526764ddea7
Instruction Fuzzy Hash: 7321C131A199198FE794FB3CC4599B977E2FF98301B4445B6E00DC72A2EE28D845C780

Function 00007FFAACCA1BD5 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cc30f3edd493ee133b86f86bc3d7b28c72dba5fb56661ed2a16238217945e9
Instruction ID: ff6e3838fa35afed8c6c6fa88096add7c7a29d1ad892136d518114a106ab5a7a
Opcode Fuzzy Hash: 99cc30f3edd493ee133b86f86bc3d7b28c72dba5fb56661ed2a16238217945e9
Instruction Fuzzy Hash: D13180716696458BF304E72CC096BF5BF61AF89314FC045E8D44E877DADB28A610C353

Function 00007FFAACCA276A Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e60681a80cada8276c6c98e624700e50f0cdfff8f508fafd2c77f69c3847c18
Instruction ID: b7b6f6dd15ed1f91ad85e380491c8440c38ff59cb8000f814bf467eb28e63dec
Opcode Fuzzy Hash: 9e60681a80cada8276c6c98e624700e50f0cdfff8f508fafd2c77f69c3847c18
Instruction Fuzzy Hash: 64116661B1CA454EE74CEB6CE0157BEB6D1EF99314F50457DE08EC3283DE289546828B

Function 00007FFAACCA2895 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c57c32fbca63fd1f582a5ef68ce84f775d18d82e66449f06c1d550673fa7e38
Instruction ID: 335b4caa16a190e18e5a43c011cfca9c364d2b5252109b3c21d95286484d276f
Opcode Fuzzy Hash: 3c57c32fbca63fd1f582a5ef68ce84f775d18d82e66449f06c1d550673fa7e38
Instruction Fuzzy Hash: 1411E921A0E7C94FE347E7389499AB53FD1EF87211B0941F7E08DCB1A3D9588846C352

Function 00007FFAACCA1620 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb6642ba8521079e75d4020429ec018c7124e9fac6524b8e0561f8d870cd8b4
Instruction ID: 0fc9b979b8237cb6bb7d862d6a719612e8240accb1334c82b7f6c7837be6205f
Opcode Fuzzy Hash: bfb6642ba8521079e75d4020429ec018c7124e9fac6524b8e0561f8d870cd8b4
Instruction Fuzzy Hash: 1F01C81160DA994FD799E73C94696A53FE2EF8E71170941FBD04CCB1A3C9188C0583D1

Function 00007FFAACCA0DA8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d96c8dfdce53826afdfa2c51797113ebb38cb248f10f27907145e5b32979661
Instruction ID: e18b3d8639dd238c6fc63ef0872f6f3a03f3b8fc89766b37e9061bb91f872f19
Opcode Fuzzy Hash: 8d96c8dfdce53826afdfa2c51797113ebb38cb248f10f27907145e5b32979661
Instruction Fuzzy Hash: 74F0786392DE8A9FF28AD26C644A5F47BC1EF4626070401B6D00EC3686DD44B88943C2

Function 00007FFAACCA1DE8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c468e3786a3ce58c1b4c83f2928b3d147cc50a86d55b49e0ab6340ab001a0ea
Instruction ID: 7a47bb9bc2eae0b0d2b43bce4a250f3965791d5c7539393cf4647f9b2d418808
Opcode Fuzzy Hash: 0c468e3786a3ce58c1b4c83f2928b3d147cc50a86d55b49e0ab6340ab001a0ea
Instruction Fuzzy Hash: 07E09222B19C1D4FAB98FB7D848DF7962C6EBAC31171045F6E40DC72A2DC18DC869380

Function 00007FFAACCA094D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1309446921.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaacca0000_kz7iLmqRuq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aae3a8b3b31dbbf2a358f6550b9d8288289dd5c635fdbd123bb6defe56aa0d0
Instruction ID: e39c723f2dba7fc4dc121fb0e638f405dfaccb477abc436a68f83345d89afbee
Opcode Fuzzy Hash: 9aae3a8b3b31dbbf2a358f6550b9d8288289dd5c635fdbd123bb6defe56aa0d0
Instruction Fuzzy Hash: CDE08662F9E9168BF89A777C600A1BC1182DF95691B40447AE40ED66DBDC1DDE4203C9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kz7iLmqRuq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\kz7iLmqRuq.exe.log

C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
kz7iLmqRuq.exe

Function 00007FFAACCB34E5 Relevance: 1.7, APIs: 1, Instructions: 152
fileCOMMON

Function 00007FFAACCB3529 Relevance: 1.6, APIs: 1, Instructions: 112
fileCOMMON

Function 00007FFAACFA1CBA Relevance: 4.6, Strings: 3, Instructions: 887
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre