Windows
Analysis Report
R86BRY7DdC.exe
Overview
General Information
Sample name: | R86BRY7DdC.exerenamed because original name is a hash value |
Original sample name: | 728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767.exe |
Analysis ID: | 1483419 |
MD5: | d747188c998cbd80a03250d578236e29 |
SHA1: | cb2aff28e4271a441d0e55dce58783fb224902ab |
SHA256: | 728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767 |
Tags: | exeinvestdirectinsurance-com |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
R86BRY7DdC.exe (PID: 7148 cmdline:
"C:\Users\ user\Deskt op\R86BRY7 DdC.exe" MD5: D747188C998CBD80A03250D578236E29) MSBuild.exe (PID: 6376 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\MSB uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232) MSBuild.exe (PID: 6400 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\MSB uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
404 Keylogger, Snake Keylogger | Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. | No Attribution |
{"Exfil Mode": "SMTP", "Username": "info@arvet-jo.com", "Password": "aIVs)Mt2Y+u[", "Host": "mail.arvet-jo.com", "Port": "587"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
MALWARE_Win_SnakeKeylogger | Detects Snake Keylogger | ditekSHen |
| |
Click to see the 13 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
MAL_Envrial_Jan18_1 | Detects Encrial credential stealer malware | Florian Roth |
| |
Click to see the 15 entries |
System Summary |
---|
Source: | Author: Kiran kumar s, oscd.community: |
Timestamp: | 2024-07-27T11:39:07.740293+0200 |
SID: | 2803274 |
Source Port: | 49732 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-27T11:39:11.959037+0200 |
SID: | 2803274 |
Source Port: | 49735 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-27T11:39:08.709920+0200 |
SID: | 2803274 |
Source Port: | 49732 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-27T11:39:02.041719+0200 |
SID: | 2803270 |
Source Port: | 49731 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-27T11:39:00.794915+0200 |
SID: | 2803270 |
Source Port: | 49730 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-27T11:39:10.262138+0200 |
SID: | 2803305 |
Source Port: | 49734 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | Unknown Traffic |
Timestamp: | 2024-07-27T11:39:57.966819+0200 |
SID: | 2022930 |
Source Port: | 443 |
Destination Port: | 49752 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 2024-07-27T11:39:19.816051+0200 |
SID: | 2022930 |
Source Port: | 443 |
Destination Port: | 49740 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 2024-07-27T11:39:12.575107+0200 |
SID: | 2803305 |
Source Port: | 49736 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | Unknown Traffic |
Timestamp: | 2024-07-27T11:39:15.631472+0200 |
SID: | 2803305 |
Source Port: | 49738 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | Unknown Traffic |
Click to jump to signature section
AV Detection |
---|
Source: | Malware Configuration Extractor: |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Integrated Neural Analysis Model: |
Location Tracking |
---|
Source: | DNS query: |
Source: | HTTPS traffic detected: |
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: |
Source: | Code function: | 2_2_032CEE68 | |
Source: | Code function: | 2_2_032CEE68 | |
Source: | Code function: | 2_2_032CE388 | |
Source: | Code function: | 2_2_032CEB9B | |
Source: | Code function: | 2_2_032CE9BB |
Networking |
---|
Source: | File source: | ||
Source: | File source: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: |
Source: | ASN Name: | ||
Source: | ASN Name: |
Source: | JA3 fingerprint: | ||
Source: | JA3 fingerprint: |
Source: | DNS query: | ||
Source: | DNS query: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTPS traffic detected: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | Code function: | 0_2_00007FFD9B87166C |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | HTTPS traffic detected: |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Code function: | 2_2_032CB328 | |
Source: | Code function: | 2_2_032C6108 | |
Source: | Code function: | 2_2_032CC190 | |
Source: | Code function: | 2_2_032C6730 | |
Source: | Code function: | 2_2_032CC790 | |
Source: | Code function: | 2_2_032CBBD2 | |
Source: | Code function: | 2_2_032CCA70 | |
Source: | Code function: | 2_2_032C4AD9 | |
Source: | Code function: | 2_2_032C9858 | |
Source: | Code function: | 2_2_032CEE68 | |
Source: | Code function: | 2_2_032CBEB0 | |
Source: | Code function: | 2_2_032CCD52 | |
Source: | Code function: | 2_2_032CE379 | |
Source: | Code function: | 2_2_032CE388 | |
Source: | Code function: | 2_2_032C3572 | |
Source: | Code function: | 2_2_032CB4F2 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: |
Source: | Classification label: |
Source: | File created: | Jump to behavior |
Source: | Mutant created: |
Source: | Static PE information: |
Source: | Static file information: |
Source: | Key opened: | Jump to behavior |
Source: | Binary or memory string: |
Source: | ReversingLabs: | ||
Source: | Virustotal: |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Binary string: |
Data Obfuscation |
---|
Source: | .Net Code: |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior |
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Process information queried: | Jump to behavior |
Source: | Process token adjusted: | Jump to behavior | ||
Source: | Process token adjusted: | Jump to behavior |
Source: | Memory allocated: | Jump to behavior |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Memory allocated: | Jump to behavior |
Source: | Memory written: | Jump to behavior |
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | File opened: | Jump to behavior | ||
Source: | Key opened: | Jump to behavior |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 311 Process Injection | 1 Masquerading | 1 OS Credential Dumping | 1 Security Software Discovery | Remote Services | 1 Email Collection | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Disable or Modify Tools | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | 11 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 31 Virtualization/Sandbox Evasion | Security Account Manager | 31 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | 1 Data from Local System | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 311 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 13 Application Layer Protocol | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | 1 System Network Configuration Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Obfuscated Files or Information | Cached Domain Credentials | 13 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Software Packing | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
42% | ReversingLabs | Win32.Trojan.Generic | ||
32% | Virustotal | Browse |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
reallyfreegeoip.org | 188.114.96.3 | true | true |
| unknown |
investdirectinsurance.com | 172.67.189.102 | true | false | unknown | |
fp2e7a.wpc.phicdn.net | 192.229.221.95 | true | false |
| unknown |
checkip.dyndns.com | 193.122.6.168 | true | true |
| unknown |
checkip.dyndns.org | unknown | unknown | true |
| unknown |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
true |
| unknown | |
false |
| unknown | |
false |
| unknown | |
false |
| unknown |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
193.122.6.168 | checkip.dyndns.com | United States | 31898 | ORACLE-BMC-31898US | true | |
188.114.96.3 | reallyfreegeoip.org | European Union | 13335 | CLOUDFLARENETUS | true | |
172.67.189.102 | investdirectinsurance.com | United States | 13335 | CLOUDFLARENETUS | false |
Joe Sandbox version: | 40.0.0 Tourmaline |
Analysis ID: | 1483419 |
Start date and time: | 2024-07-27 11:38:08 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 7m 32s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 8 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | R86BRY7DdC.exerenamed because original name is a hash value |
Original Sample Name: | 728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767.exe |
Detection: | MAL |
Classification: | mal100.troj.spyw.evad.winEXE@5/3@3/3 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 40.68.123.157, 93.184.221.240, 192.229.221.95, 13.95.31.18
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
- Execution Graph export aborted for target MSBuild.exe, PID 6400 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Time | Type | Description |
---|---|---|
05:39:07 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
193.122.6.168 | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
188.114.96.3 | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | FormBook, PureLog Stealer | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
Get hash | malicious | GuLoader, Remcos | Browse |
| ||
Get hash | malicious | FormBook, PureLog Stealer | Browse |
| ||
Get hash | malicious | FormBook, PureLog Stealer | Browse |
| ||
Get hash | malicious | Remcos | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
reallyfreegeoip.org | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
investdirectinsurance.com | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Lokibot | Browse |
| ||
Get hash | malicious | Lokibot | Browse |
| ||
checkip.dyndns.com | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
fp2e7a.wpc.phicdn.net | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
ORACLE-BMC-31898US | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
CLOUDFLARENETUS | Get hash | malicious | Remcos | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | LummaC | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | WSHRAT | Browse |
| ||
Get hash | malicious | LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT | Browse |
| ||
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT | Browse |
| ||
Get hash | malicious | LummaC, Go Injector, LummaC Stealer, SmokeLoader | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
CLOUDFLARENETUS | Get hash | malicious | Remcos | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | LummaC | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | WSHRAT | Browse |
| ||
Get hash | malicious | LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT | Browse |
| ||
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT | Browse |
| ||
Get hash | malicious | LummaC, Go Injector, LummaC Stealer, SmokeLoader | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Quasar | Browse |
| ||
Get hash | malicious | Lokibot | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Remcos | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | WSHRAT | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | FormBook, GuLoader | Browse |
| ||
Get hash | malicious | Amadey | Browse |
| ||
Get hash | malicious | Amadey, SmokeLoader | Browse |
|
Process: | C:\Users\user\Desktop\R86BRY7DdC.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 425 |
Entropy (8bit): | 5.357964438493834 |
Encrypted: | false |
SSDEEP: | 12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk |
MD5: | D8F8A79B5C09FCB6F44E8CFFF11BF7CA |
SHA1: | 669AFE705130C81BFEFECD7CC216E6E10E72CB81 |
SHA-256: | 91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406 |
SHA-512: | C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767 |
Malicious: | true |
Reputation: | moderate, very likely benign file |
Preview: |
Process: | C:\Users\user\Desktop\R86BRY7DdC.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 47616 |
Entropy (8bit): | 7.3984749546983055 |
Encrypted: | false |
SSDEEP: | 768:bRinnuikZHazYr+sPVlc1/Sdi0bNxf6lj1rEpBdE4DYywm9Tpfb+pSuGmyZCQrUz:cnpkZHIcs1/rBLDmRBbCqZCQIsPS |
MD5: | 3E3D6FD0B466B60CA1E91DC596C05DF3 |
SHA1: | 9E09372C4597A6405DF167DFE5C2671F1F62A706 |
SHA-256: | 8F60AA9F4D6672F149B1873CBDB398600A3250019A3CDBB000814C23B92E7C8E |
SHA-512: | FA052957886D4998773AFF3329D3154911DA49D8302E8EC617BBCECF32C4B10552001BE57FDCF0A99CFC1139978B23CE7C35827780E789C2CFA9A3E3F2A179A5 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\R86BRY7DdC.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 400896 |
Entropy (8bit): | 7.485818194995349 |
Encrypted: | false |
SSDEEP: | 6144:kezaT+J0CyGxSuWvmCOX0P/R5GqWtfIWcklvVvZjrJvuaG9ZlSvMhweOghtwL5mu:oayGxSz/RWfPptZjrcH9W1Map |
MD5: | 0F29EAAB32B1A3642F3A1C9779E07CA9 |
SHA1: | 1D16FED2305B264C2F59472A34A5D79E5B90EFC2 |
SHA-256: | 44A5B6AB678DB0E08A09B495A78784903F84365CDB768DEE72AA15EDCA170665 |
SHA-512: | 0D707D523A2B4907F7D8B03A911A93317E919AAA9FF1227AB0EA9FE537D685F6D1970B793111491092885EC78889D8870F77F04C5AC00B0C01F7C9DA8FC88459 |
Malicious: | false |
Reputation: | low |
Preview: |
File type: | |
Entropy (8bit): | 6.5610483430148685 |
TrID: |
|
File name: | R86BRY7DdC.exe |
File size: | 294'400 bytes |
MD5: | d747188c998cbd80a03250d578236e29 |
SHA1: | cb2aff28e4271a441d0e55dce58783fb224902ab |
SHA256: | 728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767 |
SHA512: | 569acb73c8d233d08bc5d803e19cecf9995850d85c46812a490c23360d376bf4bccc036310832b57e589bc286aa3226b035ec248ec76b35d2c10ed4074f4e205 |
SSDEEP: | 3072:hOlcp8wD7b6DhT4PrzD8VHCydY+pkzDqVHzYdKwDdomYcQGqKfjlOj0EdZdzdAHX:ICpDGFT4QndzYdKwDdomXfjc0EH2 |
TLSH: | 56548DA033A8C42AD6EF177650F056946735A9425741EB5E38DE38DC4FA67030F22BBB |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p.f.................z..........^.... ........@.. ....................................@................................ |
Icon Hash: | 90cececece8e8eb0 |
Entrypoint: | 0x44985e |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | EXECUTABLE_IMAGE |
DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Time Stamp: | 0x66A3701C [Fri Jul 26 09:45:00 2024 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 4 |
OS Version Minor: | 0 |
File Version Major: | 4 |
File Version Minor: | 0 |
Subsystem Version Major: | 4 |
Subsystem Version Minor: | 0 |
Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
Instruction |
---|
jmp dword ptr [0044986Ch] |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
inc eax |
cwde |
add al, 00h |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
sbb al, 70h |
mov dword ptr [00000066h], eax |
add byte ptr [edx], al |
add byte ptr [eax], al |
add byte ptr [eax+eax+00h], cl |
add byte ptr [eax-6FFFFB68h], dl |
jp 00007FFACD180776h |
add byte ptr [edx+53h], dl |
inc esp |
push ebx |
imul esi, dword ptr [ebx+7Ah], B4233199h |
dec ebx |
stosd |
jle 00007FFACD1807DEh |
push edx |
dec dword ptr [edi+esi*2+000001F7h] |
add byte ptr [ebx+3Ah], al |
pop esp |
push ebp |
jnc 00007FFACD1807D7h |
jc 00007FFACD1807E5h |
pop esp |
inc ecx |
insd |
imul ebp, dword ptr [esi+69h], 61727473h |
je 00007FFACD1807E1h |
jc 00007FFACD1807CEh |
inc esp |
jnc 00007FFACD1807DEh |
je 00007FFACD1807E1h |
jo 00007FFACD1807CEh |
dec edi |
jne 00007FFACD1807E6h |
jo 00007FFACD1807E7h |
je 00007FFACD1807E5h |
pop esp |
inc ecx |
bound ebp, dword ptr [eax+65h] |
imul ebp, dword ptr [ecx+73h], 6Fh |
jo 00007FFACD1807D7h |
bound eax, dword ptr [eax] |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
add byte ptr [eax], al |
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x49810 | 0x4c | .text |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x4a000 | 0xc | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x49874 | 0x1c | .text |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x4986c | 0x8 | .text |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2000 | 0x48 | .text |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x2000 | 0x478dc | 0x47a00 | c48136579667a30785fd5d14c5d507d0 | False | 0.4609613601657941 | data | 6.572522382489345 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.reloc | 0x4a000 | 0xc | 0x200 | eeaea06bc089e27011c9604df831d8a6 | False | 0.044921875 | data | 0.10191042566270775 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
DLL | Import |
---|---|
mscoree.dll | _CorExeMain |
Timestamp | Protocol | SID | Signature | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|---|---|---|
2024-07-27T11:39:07.740293+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
2024-07-27T11:39:11.959037+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 49735 | 80 | 192.168.2.4 | 193.122.6.168 |
2024-07-27T11:39:08.709920+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
2024-07-27T11:39:02.041719+0200 | TCP | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
2024-07-27T11:39:00.794915+0200 | TCP | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
2024-07-27T11:39:10.262138+0200 | TCP | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
2024-07-27T11:39:57.966819+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 49752 | 40.68.123.157 | 192.168.2.4 |
2024-07-27T11:39:19.816051+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 49740 | 40.68.123.157 | 192.168.2.4 |
2024-07-27T11:39:12.575107+0200 | TCP | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
2024-07-27T11:39:15.631472+0200 | TCP | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Jul 27, 2024 11:38:54.896601915 CEST | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
Jul 27, 2024 11:38:59.938163996 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:38:59.938208103 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:38:59.938290119 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:38:59.943130970 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:38:59.943140030 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.462336063 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.462559938 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.510560036 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.510581017 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.510962009 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.511049986 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.513142109 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.560529947 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.794889927 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.794931889 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.794964075 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.794986963 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.794998884 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.795053959 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.796227932 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.796293974 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.796300888 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.796513081 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.797801018 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.798243999 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.799299955 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.800508022 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.800517082 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.800574064 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.800873041 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.800926924 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.800934076 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.801446915 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.802386045 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.802522898 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.802530050 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.803088903 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.877005100 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.877068996 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.886984110 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.887039900 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.887051105 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.887624979 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.887937069 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.888510942 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.889379978 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.889424086 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.889441013 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.889482975 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.890863895 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.890928984 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.890935898 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.891887903 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.892326117 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.892381907 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.892388105 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.892430067 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.893815994 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.893973112 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.893980980 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.894022942 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.895251989 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.895287991 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.895307064 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.895363092 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.896418095 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.896506071 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.896514893 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.896761894 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.897628069 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.898776054 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.898797989 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.898803949 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.898844004 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.898844004 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.898849964 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.899343967 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.900182009 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.900247097 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.900254011 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.900407076 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.960165024 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.960510969 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.979340076 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.979393959 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.979398966 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.979407072 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.979465008 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:00.979480028 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.979480028 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.979559898 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.982228994 CEST | 49730 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:00.982249975 CEST | 443 | 49730 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:01.216507912 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:01.216552019 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:01.216768026 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:01.217010021 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:01.217017889 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:01.684470892 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:01.684596062 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:01.685237885 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:01.685244083 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:01.685369015 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:01.685373068 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.041716099 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.041773081 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.041817904 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.041836023 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.041855097 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.041899920 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.042839050 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.042912960 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.042918921 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.042978048 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.044164896 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.044246912 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.045507908 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.045574903 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.045579910 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.045623064 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.046905994 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.046967030 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.046972036 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.047013044 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.048342943 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.048398972 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.048403978 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.048449993 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.127455950 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.127604961 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.127618074 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.127670050 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.128551006 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.128602028 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.128612041 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.128617048 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.128648043 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.128699064 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.129750013 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.129801035 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.131087065 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.131139994 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.131145954 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.131191969 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.132390976 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.132441044 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.132446051 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.132451057 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.132498026 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.133740902 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.133800983 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.135114908 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.135178089 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.135179043 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.135190010 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.135226965 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.136151075 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.136207104 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.136212111 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.136261940 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.137214899 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.137271881 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.137278080 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.137322903 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.138329029 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.138381958 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.138387918 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.138431072 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.139395952 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.139504910 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.210251093 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.210377932 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.210386038 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.210459948 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.214131117 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.214215994 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.214477062 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.214534044 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.214539051 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.214596987 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.215620995 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.215679884 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.215687990 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.215744972 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.216664076 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.216725111 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.217885971 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.217953920 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.220093966 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.220169067 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.221045971 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.221105099 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.221996069 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.222069025 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.223084927 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.223157883 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.223990917 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.224051952 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.224941969 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.224997044 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.225963116 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.226025105 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.226881027 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.226933956 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.228678942 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.228738070 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.229466915 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.229521036 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.302767038 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.302829981 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.303683996 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.303781986 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.305509090 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.305557013 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.305565119 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.305602074 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.306443930 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.306499958 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.308245897 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.308278084 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.308312893 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.308319092 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.308327913 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.308352947 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.310062885 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.310116053 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.310791016 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.310837030 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.311517954 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.311580896 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.312987089 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.313045025 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.313050032 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.313092947 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.314398050 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.314429045 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.314450979 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.314456940 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.314481020 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.314496994 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.315969944 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.315999985 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.316036940 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.316041946 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.316087008 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.316087008 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.317661047 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.317728043 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.318049908 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.318104029 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.318743944 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.318805933 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.319662094 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.319716930 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.320585966 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.320638895 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.321511030 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.321554899 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.321579933 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.321585894 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.321597099 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.321623087 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.388941050 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.388992071 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.389058113 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.389077902 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.389117002 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.389117002 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.390332937 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.390367031 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.390398026 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.390404940 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.390428066 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.390439987 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.391047001 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.391108990 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.392451048 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.392503977 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.396092892 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.396100044 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.396157026 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.396189928 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.396219969 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.396236897 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.396281958 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.396708012 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.396765947 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.400990009 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.401007891 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.401062012 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.401070118 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.401106119 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.401679993 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.401736975 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.402383089 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.402436018 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.403078079 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.403137922 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.405543089 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.405603886 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.409444094 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.409459114 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.409519911 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.409524918 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.409568071 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.411648035 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.411712885 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.413002014 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.413069963 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.413691998 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.413749933 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.414403915 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.414465904 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.416568995 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.416635036 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.416635036 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.416647911 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.416686058 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.419104099 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.419143915 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.419176102 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.419182062 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.419239998 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.419374943 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.430713892 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.430818081 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.431545973 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.431709051 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.497613907 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.497803926 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.500530005 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.500551939 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.500583887 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.500614882 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.500632048 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.500648022 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.500674963 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.503375053 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.503415108 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.503458977 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.503467083 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.503484964 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.503562927 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.506608009 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.506645918 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.506678104 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.506690025 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.506705999 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.506724119 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.507468939 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.507536888 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.507543087 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.507580042 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.513910055 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.513977051 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.515307903 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.515367985 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.515405893 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.515414953 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.515433073 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.515455008 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.518129110 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.518161058 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.518193960 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.518203020 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.518218994 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.518237114 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.520021915 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.520054102 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.520087957 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.520093918 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.520118952 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.520133018 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.520925045 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.520989895 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.520996094 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.521009922 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.521034002 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.521056890 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.521122932 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.521140099 CEST | 443 | 49731 | 172.67.189.102 | 192.168.2.4 |
Jul 27, 2024 11:39:02.521150112 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:02.521182060 CEST | 49731 | 443 | 192.168.2.4 | 172.67.189.102 |
Jul 27, 2024 11:39:03.130156040 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:03.135104895 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:03.135169029 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:03.135523081 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:03.148968935 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:04.506027937 CEST | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
Jul 27, 2024 11:39:06.033034086 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:06.040359974 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:06.045588017 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:07.689614058 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:07.740293026 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:07.754895926 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:07.754923105 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:07.754995108 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:07.763428926 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:07.763447046 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.273577929 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.273720026 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.280014038 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.280025959 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.280356884 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.334053993 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.339713097 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.384496927 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.465465069 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.465553045 CEST | 443 | 49733 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.465610027 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.471746922 CEST | 49733 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.474976063 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:08.480046988 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:08.662942886 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:08.666317940 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.666363001 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.666559935 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.668504000 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:08.668520927 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:08.709919930 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:10.107799053 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:10.109572887 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:10.109597921 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:10.262206078 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:10.262442112 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:10.262520075 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:10.262955904 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:10.266041040 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:10.267195940 CEST | 49735 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:10.275019884 CEST | 80 | 49735 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:10.275115967 CEST | 49735 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:10.275222063 CEST | 49735 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:10.275248051 CEST | 80 | 49732 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:10.275300980 CEST | 49732 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:10.279922962 CEST | 80 | 49735 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:11.912939072 CEST | 80 | 49735 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:11.914244890 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:11.914293051 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:11.914366007 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:11.914608955 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:11.914618969 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:11.959037066 CEST | 49735 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:12.429239035 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:12.430901051 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:12.430921078 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:12.575180054 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:12.575413942 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:12.575474977 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:12.575788975 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:12.580394983 CEST | 49737 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:12.588290930 CEST | 80 | 49737 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:12.588396072 CEST | 49737 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:12.588500023 CEST | 49737 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:12.596921921 CEST | 80 | 49737 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:15.003487110 CEST | 80 | 49737 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:15.004801989 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:15.004848957 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:15.005017042 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:15.005489111 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:15.005501986 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:15.053112030 CEST | 49737 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:15.489648104 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:15.492516994 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:15.492552042 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:15.631458998 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:15.631704092 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:15.631788015 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:15.632116079 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:15.635015011 CEST | 49737 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:15.635976076 CEST | 49739 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:15.640507936 CEST | 80 | 49737 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:15.640578032 CEST | 49737 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:15.640984058 CEST | 80 | 49739 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:15.641060114 CEST | 49739 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:15.641138077 CEST | 49739 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:15.646049023 CEST | 80 | 49739 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:18.317209959 CEST | 80 | 49739 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:18.365309954 CEST | 49739 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:18.536145926 CEST | 49739 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:18.537261963 CEST | 49741 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:18.541646004 CEST | 80 | 49739 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:18.541696072 CEST | 49739 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:18.542210102 CEST | 80 | 49741 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:18.542944908 CEST | 49741 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:18.543317080 CEST | 49741 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:18.548137903 CEST | 80 | 49741 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:19.278050900 CEST | 80 | 49741 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:19.279592991 CEST | 49743 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:19.279645920 CEST | 443 | 49743 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:19.279927015 CEST | 49743 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:19.279927015 CEST | 49743 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:19.279968977 CEST | 443 | 49743 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:19.320507050 CEST | 49741 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:19.819269896 CEST | 443 | 49743 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:19.820880890 CEST | 49743 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:19.820914030 CEST | 443 | 49743 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:19.973328114 CEST | 443 | 49743 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:19.973584890 CEST | 443 | 49743 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:19.973716974 CEST | 49743 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:19.974061966 CEST | 49743 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:19.977116108 CEST | 49741 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:19.978203058 CEST | 49746 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:20.018923044 CEST | 80 | 49741 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:20.018940926 CEST | 80 | 49746 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:20.019054890 CEST | 49741 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:20.019069910 CEST | 49746 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:20.019205093 CEST | 49746 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:20.036623001 CEST | 80 | 49746 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:22.027405024 CEST | 49723 | 80 | 192.168.2.4 | 199.232.214.172 |
Jul 27, 2024 11:39:22.040047884 CEST | 80 | 49723 | 199.232.214.172 | 192.168.2.4 |
Jul 27, 2024 11:39:22.040116072 CEST | 49723 | 80 | 192.168.2.4 | 199.232.214.172 |
Jul 27, 2024 11:39:22.288875103 CEST | 80 | 49746 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:22.290345907 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:22.290395975 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:22.290524006 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:22.290725946 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:22.290734053 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:22.334073067 CEST | 49746 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:22.772665024 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:22.781184912 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:22.781209946 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:22.917249918 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:22.917541981 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:22.917606115 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:22.918203115 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:22.920897961 CEST | 49746 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:22.921808958 CEST | 49750 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:22.928246021 CEST | 80 | 49746 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:22.928262949 CEST | 80 | 49750 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:22.928309917 CEST | 49746 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:22.928339005 CEST | 49750 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:22.928464890 CEST | 49750 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:22.933420897 CEST | 80 | 49750 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:24.345159054 CEST | 80 | 49750 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:39:24.350128889 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:24.350188971 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:24.350269079 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:24.350497007 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:24.350513935 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:24.396593094 CEST | 49750 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:39:24.824812889 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:24.832823038 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:24.832837105 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:24.962956905 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:24.963205099 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Jul 27, 2024 11:39:24.963277102 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:39:24.963692904 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Jul 27, 2024 11:40:10.211182117 CEST | 49724 | 80 | 192.168.2.4 | 199.232.214.172 |
Jul 27, 2024 11:40:10.217834949 CEST | 80 | 49724 | 199.232.214.172 | 192.168.2.4 |
Jul 27, 2024 11:40:10.218014956 CEST | 49724 | 80 | 192.168.2.4 | 199.232.214.172 |
Jul 27, 2024 11:40:16.967448950 CEST | 80 | 49735 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:40:16.968373060 CEST | 49735 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:40:29.346906900 CEST | 80 | 49750 | 193.122.6.168 | 192.168.2.4 |
Jul 27, 2024 11:40:29.347013950 CEST | 49750 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:41:04.350128889 CEST | 49750 | 80 | 192.168.2.4 | 193.122.6.168 |
Jul 27, 2024 11:41:04.355201960 CEST | 80 | 49750 | 193.122.6.168 | 192.168.2.4 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Jul 27, 2024 11:38:59.855787992 CEST | 52016 | 53 | 192.168.2.4 | 1.1.1.1 |
Jul 27, 2024 11:38:59.931802034 CEST | 53 | 52016 | 1.1.1.1 | 192.168.2.4 |
Jul 27, 2024 11:39:03.115674019 CEST | 53503 | 53 | 192.168.2.4 | 1.1.1.1 |
Jul 27, 2024 11:39:03.123480082 CEST | 53 | 53503 | 1.1.1.1 | 192.168.2.4 |
Jul 27, 2024 11:39:07.745228052 CEST | 52755 | 53 | 192.168.2.4 | 1.1.1.1 |
Jul 27, 2024 11:39:07.754160881 CEST | 53 | 52755 | 1.1.1.1 | 192.168.2.4 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Jul 27, 2024 11:38:59.855787992 CEST | 192.168.2.4 | 1.1.1.1 | 0x2180 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Jul 27, 2024 11:39:03.115674019 CEST | 192.168.2.4 | 1.1.1.1 | 0x3eee | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Jul 27, 2024 11:39:07.745228052 CEST | 192.168.2.4 | 1.1.1.1 | 0x6345 | Standard query (0) | A (IP address) | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Jul 27, 2024 11:38:59.931802034 CEST | 1.1.1.1 | 192.168.2.4 | 0x2180 | No error (0) | 172.67.189.102 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:38:59.931802034 CEST | 1.1.1.1 | 192.168.2.4 | 0x2180 | No error (0) | 104.21.65.79 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:03.123480082 CEST | 1.1.1.1 | 192.168.2.4 | 0x3eee | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:03.123480082 CEST | 1.1.1.1 | 192.168.2.4 | 0x3eee | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:03.123480082 CEST | 1.1.1.1 | 192.168.2.4 | 0x3eee | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:03.123480082 CEST | 1.1.1.1 | 192.168.2.4 | 0x3eee | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:03.123480082 CEST | 1.1.1.1 | 192.168.2.4 | 0x3eee | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:03.123480082 CEST | 1.1.1.1 | 192.168.2.4 | 0x3eee | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:07.754160881 CEST | 1.1.1.1 | 192.168.2.4 | 0x6345 | No error (0) | 188.114.96.3 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:07.754160881 CEST | 1.1.1.1 | 192.168.2.4 | 0x6345 | No error (0) | 188.114.97.3 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:20.663800001 CEST | 1.1.1.1 | 192.168.2.4 | 0x6337 | No error (0) | fp2e7a.wpc.phicdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:20.663800001 CEST | 1.1.1.1 | 192.168.2.4 | 0x6337 | No error (0) | 192.229.221.95 | A (IP address) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:32.701962948 CEST | 1.1.1.1 | 192.168.2.4 | 0xec87 | No error (0) | fp2e7a.wpc.phicdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Jul 27, 2024 11:39:32.701962948 CEST | 1.1.1.1 | 192.168.2.4 | 0xec87 | No error (0) | 192.229.221.95 | A (IP address) | IN (0x0001) | false |
|
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.4 | 49732 | 193.122.6.168 | 80 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 27, 2024 11:39:03.135523081 CEST | 151 | OUT | |
Jul 27, 2024 11:39:06.033034086 CEST | 320 | IN | |
Jul 27, 2024 11:39:06.040359974 CEST | 127 | OUT | |
Jul 27, 2024 11:39:07.689614058 CEST | 320 | IN | |
Jul 27, 2024 11:39:08.474976063 CEST | 127 | OUT | |
Jul 27, 2024 11:39:08.662942886 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.4 | 49735 | 193.122.6.168 | 80 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 27, 2024 11:39:10.275222063 CEST | 127 | OUT | |
Jul 27, 2024 11:39:11.912939072 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.4 | 49737 | 193.122.6.168 | 80 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 27, 2024 11:39:12.588500023 CEST | 151 | OUT | |
Jul 27, 2024 11:39:15.003487110 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.4 | 49739 | 193.122.6.168 | 80 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 27, 2024 11:39:15.641138077 CEST | 151 | OUT | |
Jul 27, 2024 11:39:18.317209959 CEST | 730 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.4 | 49741 | 193.122.6.168 | 80 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 27, 2024 11:39:18.543317080 CEST | 151 | OUT | |
Jul 27, 2024 11:39:19.278050900 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.4 | 49746 | 193.122.6.168 | 80 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 27, 2024 11:39:20.019205093 CEST | 151 | OUT | |
Jul 27, 2024 11:39:22.288875103 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.4 | 49750 | 193.122.6.168 | 80 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 27, 2024 11:39:22.928464890 CEST | 151 | OUT | |
Jul 27, 2024 11:39:24.345159054 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.4 | 49730 | 172.67.189.102 | 443 | 7148 | C:\Users\user\Desktop\R86BRY7DdC.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:00 UTC | 136 | OUT | |
2024-07-27 09:39:00 UTC | 681 | IN | |
2024-07-27 09:39:00 UTC | 688 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN | |
2024-07-27 09:39:00 UTC | 1369 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.4 | 49731 | 172.67.189.102 | 443 | 7148 | C:\Users\user\Desktop\R86BRY7DdC.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:01 UTC | 134 | OUT | |
2024-07-27 09:39:02 UTC | 685 | IN | |
2024-07-27 09:39:02 UTC | 684 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN | |
2024-07-27 09:39:02 UTC | 1369 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.4 | 49733 | 188.114.96.3 | 443 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:08 UTC | 84 | OUT | |
2024-07-27 09:39:08 UTC | 703 | IN | |
2024-07-27 09:39:08 UTC | 340 | IN | |
2024-07-27 09:39:08 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.4 | 49734 | 188.114.96.3 | 443 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:10 UTC | 60 | OUT | |
2024-07-27 09:39:10 UTC | 709 | IN | |
2024-07-27 09:39:10 UTC | 340 | IN | |
2024-07-27 09:39:10 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.4 | 49736 | 188.114.96.3 | 443 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:12 UTC | 60 | OUT | |
2024-07-27 09:39:12 UTC | 705 | IN | |
2024-07-27 09:39:12 UTC | 340 | IN | |
2024-07-27 09:39:12 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.4 | 49738 | 188.114.96.3 | 443 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:15 UTC | 60 | OUT | |
2024-07-27 09:39:15 UTC | 701 | IN | |
2024-07-27 09:39:15 UTC | 340 | IN | |
2024-07-27 09:39:15 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.4 | 49743 | 188.114.96.3 | 443 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:19 UTC | 84 | OUT | |
2024-07-27 09:39:19 UTC | 707 | IN | |
2024-07-27 09:39:19 UTC | 340 | IN | |
2024-07-27 09:39:19 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.4 | 49749 | 188.114.96.3 | 443 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:22 UTC | 84 | OUT | |
2024-07-27 09:39:22 UTC | 701 | IN | |
2024-07-27 09:39:22 UTC | 340 | IN | |
2024-07-27 09:39:22 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
8 | 192.168.2.4 | 49751 | 188.114.96.3 | 443 | 6400 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-27 09:39:24 UTC | 84 | OUT | |
2024-07-27 09:39:24 UTC | 711 | IN | |
2024-07-27 09:39:24 UTC | 340 | IN | |
2024-07-27 09:39:24 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 05:38:58 |
Start date: | 27/07/2024 |
Path: | C:\Users\user\Desktop\R86BRY7DdC.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x5d0000 |
File size: | 294'400 bytes |
MD5 hash: | D747188C998CBD80A03250D578236E29 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 1 |
Start time: | 05:39:01 |
Start date: | 27/07/2024 |
Path: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0xb0000 |
File size: | 262'432 bytes |
MD5 hash: | 8FDF47E0FF70C40ED3A17014AEEA4232 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 2 |
Start time: | 05:39:01 |
Start date: | 27/07/2024 |
Path: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xe20000 |
File size: | 262'432 bytes |
MD5 hash: | 8FDF47E0FF70C40ED3A17014AEEA4232 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | high |
Has exited: | false |
Execution Graph
Execution Coverage: | 25% |
Dynamic/Decrypted Code Coverage: | 100% |
Signature Coverage: | 11.1% |
Total number of Nodes: | 27 |
Total number of Limit Nodes: | 0 |
Graph
Function 00007FFD9B87166C Relevance: 1.7, APIs: 1, Instructions: 197filenetworkCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00007FFD9B876151 Relevance: 1.7, APIs: 1, Instructions: 219injectionCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C6730 Relevance: 6.7, Strings: 5, Instructions: 439COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CB328 Relevance: 6.6, Strings: 5, Instructions: 349COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CBBD2 Relevance: 6.4, Strings: 5, Instructions: 188COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CBEB0 Relevance: 6.4, Strings: 5, Instructions: 186COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CC190 Relevance: 6.4, Strings: 5, Instructions: 185COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CC790 Relevance: 6.4, Strings: 5, Instructions: 185COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CCA70 Relevance: 6.4, Strings: 5, Instructions: 184COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CCD52 Relevance: 6.4, Strings: 5, Instructions: 184COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C4AD9 Relevance: 6.4, Strings: 5, Instructions: 183COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CB4F2 Relevance: 3.9, Strings: 3, Instructions: 150COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C9858 Relevance: 3.4, Strings: 2, Instructions: 850COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C6108 Relevance: 3.0, Strings: 2, Instructions: 509COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CEE68 Relevance: .7, Instructions: 717COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C6E58 Relevance: 10.5, Strings: 8, Instructions: 475COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C215C Relevance: 5.3, Strings: 4, Instructions: 304COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C87E9 Relevance: 4.2, Strings: 3, Instructions: 493COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C77F0 Relevance: 3.2, Strings: 2, Instructions: 692COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C56A8 Relevance: 2.8, Strings: 2, Instructions: 265COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C5C08 Relevance: 2.7, Strings: 2, Instructions: 229COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C3428 Relevance: 2.6, Strings: 2, Instructions: 112COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C0C8F Relevance: 1.7, Strings: 1, Instructions: 406COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C0CA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CA650 Relevance: 1.4, Strings: 1, Instructions: 122COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CA818 Relevance: .4, Instructions: 409COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C7438 Relevance: .2, Instructions: 201COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CD36A Relevance: .2, Instructions: 169COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CD378 Relevance: .2, Instructions: 167COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CE137 Relevance: .2, Instructions: 152COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CD030 Relevance: .1, Instructions: 135COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C3908 Relevance: .1, Instructions: 134COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CEF49 Relevance: .1, Instructions: 130COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C9A63 Relevance: .1, Instructions: 123COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C4DC8 Relevance: .1, Instructions: 101COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C76D0 Relevance: .1, Instructions: 89COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C76E0 Relevance: .1, Instructions: 87COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CA809 Relevance: .1, Instructions: 86COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C2060 Relevance: .1, Instructions: 77COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C5A60 Relevance: .1, Instructions: 76COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0304D044 Relevance: .1, Instructions: 72COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C39ED Relevance: .1, Instructions: 68COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C4DB9 Relevance: .1, Instructions: 67COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C5A70 Relevance: .1, Instructions: 59COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CE059 Relevance: .1, Instructions: 57COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C1F61 Relevance: .1, Instructions: 56COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CE068 Relevance: .1, Instructions: 54COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0304D03F Relevance: .1, Instructions: 53COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C1F08 Relevance: .1, Instructions: 53COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C5607 Relevance: .0, Instructions: 49COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CDD70 Relevance: .0, Instructions: 30COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C2010 Relevance: .0, Instructions: 27COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C2020 Relevance: .0, Instructions: 19COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C8258 Relevance: .0, Instructions: 18COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CA70D Relevance: .0, Instructions: 16COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C5EA8 Relevance: .0, Instructions: 16COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C5EB8 Relevance: .0, Instructions: 12COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C3572 Relevance: 2.8, Strings: 2, Instructions: 266COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CE388 Relevance: 1.8, Strings: 1, Instructions: 596COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CE379 Relevance: 1.4, Strings: 1, Instructions: 147COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CE9BB Relevance: .2, Instructions: 193COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032CEB9B Relevance: .1, Instructions: 116COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C21E2 Relevance: 5.1, Strings: 4, Instructions: 92COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 032C6088 Relevance: 5.0, Strings: 4, Instructions: 49COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|