Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Payload 94.75.225.exe

Overview

General Information

Sample name:Payload 94.75.225.exe
Analysis ID:1547867
MD5:c1cd02403f4ca49c8547b397dad11a21
SHA1:cee43976d68fb7f56af41e1bcfb42227a6e6e225
SHA256:69e7acf427dbfc86650bd4dad8c97c399a5c921cb1b8cca5dfc7b4a53d849ca0
Tags:94-75-225-81exeuser-JAMESWT_MHT
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected suspicious sample
Installs new ROOT certificates
Connects to several IPs in different countries
Detected TCP or UDP traffic on non-standard ports
IP address seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Sigma detected: Suspicious Outbound SMTP Connections
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64
  • Payload 94.75.225.exe (PID: 6708 cmdline: "C:\Users\user\Desktop\Payload 94.75.225.exe" MD5: C1CD02403F4CA49C8547B397DAD11A21)
    • conhost.exe (PID: 2616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections
Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 50.230.231.85, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Users\user\Desktop\Payload 94.75.225.exe, Initiated: true, ProcessId: 6708, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49805

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 97.7% probability
Source: Payload 94.75.225.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: unknownNetwork traffic detected: IP country count 23
Source: global trafficTCP traffic: 192.168.2.6:49710 -> 185.40.4.95:10443
Source: global trafficTCP traffic: 192.168.2.6:49713 -> 2.204.219.86:9001
Source: global trafficTCP traffic: 192.168.2.6:49714 -> 185.241.208.71:9000
Source: global trafficTCP traffic: 192.168.2.6:49716 -> 107.173.148.133:9001
Source: global trafficTCP traffic: 192.168.2.6:49718 -> 95.99.30.188:9001
Source: global trafficTCP traffic: 192.168.2.6:49719 -> 51.195.119.159:30443
Source: global trafficTCP traffic: 192.168.2.6:49721 -> 45.141.215.95:8430
Source: global trafficTCP traffic: 192.168.2.6:49723 -> 207.127.91.1:9021
Source: global trafficTCP traffic: 192.168.2.6:49724 -> 185.227.82.15:15259
Source: global trafficTCP traffic: 192.168.2.6:49726 -> 109.70.100.71:9005
Source: global trafficTCP traffic: 192.168.2.6:49727 -> 45.11.229.132:9001
Source: global trafficTCP traffic: 192.168.2.6:49728 -> 138.68.9.184:9001
Source: global trafficTCP traffic: 192.168.2.6:49730 -> 87.98.243.204:9000
Source: global trafficTCP traffic: 192.168.2.6:49731 -> 194.164.16.95:9001
Source: global trafficTCP traffic: 192.168.2.6:49734 -> 209.127.117.90:1004
Source: global trafficTCP traffic: 192.168.2.6:49737 -> 85.10.205.56:1003
Source: global trafficTCP traffic: 192.168.2.6:49739 -> 185.220.100.253:9100
Source: global trafficTCP traffic: 192.168.2.6:49741 -> 193.239.86.133:9001
Source: global trafficTCP traffic: 192.168.2.6:49743 -> 185.220.101.206:8443
Source: global trafficTCP traffic: 192.168.2.6:49744 -> 202.61.196.212:9001
Source: global trafficTCP traffic: 192.168.2.6:49745 -> 80.92.204.251:9001
Source: global trafficTCP traffic: 192.168.2.6:49746 -> 152.53.111.174:9088
Source: global trafficTCP traffic: 192.168.2.6:49749 -> 88.80.26.2:9001
Source: global trafficTCP traffic: 192.168.2.6:49750 -> 37.114.57.182:9001
Source: global trafficTCP traffic: 192.168.2.6:49751 -> 57.129.44.38:9300
Source: global trafficTCP traffic: 192.168.2.6:49752 -> 94.131.171.105:32616
Source: global trafficTCP traffic: 192.168.2.6:49754 -> 84.247.178.134:9002
Source: global trafficTCP traffic: 192.168.2.6:49755 -> 31.220.72.103:61040
Source: global trafficTCP traffic: 192.168.2.6:49756 -> 178.142.134.20:9001
Source: global trafficTCP traffic: 192.168.2.6:49757 -> 82.64.150.101:9001
Source: global trafficTCP traffic: 192.168.2.6:49759 -> 185.220.101.30:9002
Source: global trafficTCP traffic: 192.168.2.6:49748 -> 107.189.12.88:9001
Source: global trafficTCP traffic: 192.168.2.6:49760 -> 75.119.135.230:9001
Source: global trafficTCP traffic: 192.168.2.6:49761 -> 209.127.245.250:9000
Source: global trafficTCP traffic: 192.168.2.6:49762 -> 103.252.90.217:9200
Source: global trafficTCP traffic: 192.168.2.6:49758 -> 68.8.241.30:9001
Source: global trafficTCP traffic: 192.168.2.6:49765 -> 188.165.194.209:9001
Source: global trafficTCP traffic: 192.168.2.6:49767 -> 185.220.101.21:9001
Source: global trafficTCP traffic: 192.168.2.6:49769 -> 45.141.215.61:8430
Source: global trafficTCP traffic: 192.168.2.6:49770 -> 23.184.48.13:9001
Source: global trafficTCP traffic: 192.168.2.6:49771 -> 23.163.200.46:9000
Source: global trafficTCP traffic: 192.168.2.6:49773 -> 68.134.176.234:44433
Source: global trafficTCP traffic: 192.168.2.6:49774 -> 45.89.54.11:9001
Source: global trafficTCP traffic: 192.168.2.6:49777 -> 136.35.138.88:444
Source: global trafficTCP traffic: 192.168.2.6:49779 -> 94.26.73.162:9201
Source: global trafficTCP traffic: 192.168.2.6:49781 -> 15.204.143.192:8443
Source: global trafficTCP traffic: 192.168.2.6:49782 -> 82.65.150.138:20901
Source: global trafficTCP traffic: 192.168.2.6:49784 -> 23.88.72.105:1001
Source: global trafficTCP traffic: 192.168.2.6:49786 -> 185.220.101.48:10048
Source: global trafficTCP traffic: 192.168.2.6:49787 -> 65.21.98.72:11118
Source: global trafficTCP traffic: 192.168.2.6:49788 -> 185.220.101.50:10050
Source: global trafficTCP traffic: 192.168.2.6:49789 -> 194.88.105.30:9001
Source: global trafficTCP traffic: 192.168.2.6:49790 -> 51.68.155.147:444
Source: global trafficTCP traffic: 192.168.2.6:49793 -> 161.97.132.254:9001
Source: global trafficTCP traffic: 192.168.2.6:49794 -> 71.163.253.207:9001
Source: global trafficTCP traffic: 192.168.2.6:49795 -> 162.247.74.31:9091
Source: global trafficTCP traffic: 192.168.2.6:49797 -> 5.39.185.164:9001
Source: global trafficTCP traffic: 192.168.2.6:49798 -> 185.220.101.35:10035
Source: global trafficTCP traffic: 192.168.2.6:49799 -> 190.211.254.192:9001
Source: global trafficTCP traffic: 192.168.2.6:49796 -> 70.39.91.101:1080
Source: global trafficTCP traffic: 192.168.2.6:49803 -> 45.148.17.56:9001
Source: global trafficTCP traffic: 192.168.2.6:49806 -> 45.141.215.4:143
Source: global trafficTCP traffic: 192.168.2.6:49809 -> 81.201.202.101:9001
Source: global trafficTCP traffic: 192.168.2.6:49807 -> 95.148.2.122:9001
Source: global trafficTCP traffic: 192.168.2.6:49810 -> 209.141.47.207:9001
Source: global trafficTCP traffic: 192.168.2.6:49811 -> 84.247.160.4:9001
Source: global trafficTCP traffic: 192.168.2.6:49813 -> 178.63.41.183:8000
Source: Joe Sandbox ViewIP Address: 185.220.101.206 185.220.101.206
Source: unknownTCP traffic detected without corresponding DNS query: 185.40.4.95
Source: unknownTCP traffic detected without corresponding DNS query: 185.107.57.64
Source: unknownTCP traffic detected without corresponding DNS query: 185.107.57.64
Source: unknownTCP traffic detected without corresponding DNS query: 185.220.101.201
Source: unknownTCP traffic detected without corresponding DNS query: 185.220.101.201
Source: unknownTCP traffic detected without corresponding DNS query: 2.204.219.86
Source: unknownTCP traffic detected without corresponding DNS query: 185.241.208.71
Source: unknownTCP traffic detected without corresponding DNS query: 185.220.101.204
Source: unknownTCP traffic detected without corresponding DNS query: 185.220.101.204
Source: unknownTCP traffic detected without corresponding DNS query: 107.173.148.133
Source: unknownTCP traffic detected without corresponding DNS query: 192.42.116.179
Source: unknownTCP traffic detected without corresponding DNS query: 95.99.30.188
Source: unknownTCP traffic detected without corresponding DNS query: 51.195.119.159
Source: unknownTCP traffic detected without corresponding DNS query: 95.111.230.178
Source: unknownTCP traffic detected without corresponding DNS query: 95.111.230.178
Source: unknownTCP traffic detected without corresponding DNS query: 45.141.215.95
Source: unknownTCP traffic detected without corresponding DNS query: 67.219.107.200
Source: unknownTCP traffic detected without corresponding DNS query: 67.219.107.200
Source: unknownTCP traffic detected without corresponding DNS query: 207.127.91.1
Source: unknownTCP traffic detected without corresponding DNS query: 185.227.82.15
Source: unknownTCP traffic detected without corresponding DNS query: 109.70.100.3
Source: unknownTCP traffic detected without corresponding DNS query: 109.70.100.3
Source: unknownTCP traffic detected without corresponding DNS query: 185.40.4.95
Source: unknownTCP traffic detected without corresponding DNS query: 2.204.219.86
Source: unknownTCP traffic detected without corresponding DNS query: 185.241.208.71
Source: unknownTCP traffic detected without corresponding DNS query: 107.173.148.133
Source: unknownTCP traffic detected without corresponding DNS query: 192.42.116.179
Source: unknownTCP traffic detected without corresponding DNS query: 95.99.30.188
Source: unknownTCP traffic detected without corresponding DNS query: 51.195.119.159
Source: unknownTCP traffic detected without corresponding DNS query: 45.141.215.95
Source: unknownTCP traffic detected without corresponding DNS query: 207.127.91.1
Source: unknownTCP traffic detected without corresponding DNS query: 185.227.82.15
Source: unknownTCP traffic detected without corresponding DNS query: 109.70.100.71
Source: unknownTCP traffic detected without corresponding DNS query: 45.11.229.132
Source: unknownTCP traffic detected without corresponding DNS query: 138.68.9.184
Source: unknownTCP traffic detected without corresponding DNS query: 153.120.42.137
Source: unknownTCP traffic detected without corresponding DNS query: 87.98.243.204
Source: unknownTCP traffic detected without corresponding DNS query: 194.164.16.95
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.194.90
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.194.90
Source: unknownTCP traffic detected without corresponding DNS query: 192.42.116.189
Source: unknownTCP traffic detected without corresponding DNS query: 209.127.117.90
Source: unknownTCP traffic detected without corresponding DNS query: 20.224.145.181
Source: unknownTCP traffic detected without corresponding DNS query: 20.224.145.181
Source: unknownTCP traffic detected without corresponding DNS query: 57.128.180.74
Source: unknownTCP traffic detected without corresponding DNS query: 57.128.180.74
Source: unknownTCP traffic detected without corresponding DNS query: 85.90.207.39
Source: unknownTCP traffic detected without corresponding DNS query: 85.90.207.39
Source: unknownTCP traffic detected without corresponding DNS query: 185.220.100.253
Source: unknownTCP traffic detected without corresponding DNS query: 51.81.56.136
Source: global trafficHTTP traffic detected: GET /details?type=relay&running=true&fields=fingerprint,or_addresses HTTP/1.1Host: onionoo.torproject.orgUser-Agent: tor-relay-scannerAccept-Encoding: gzip
Source: global trafficDNS traffic detected: DNS query: onionoo.torproject.org
Source: Payload 94.75.225.exeString found in binary or memory: https://github.com/ValdikSS/tor-onionoo-mirror/raw/master/details-running-relays-fingerprint-address
Source: Payload 94.75.225.exeString found in binary or memory: https://icors.vercel.app/?flag
Source: Payload 94.75.225.exe, 00000000.00000002.2126488008.000000C000192000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://icors.vercel.app/?https%3A%2F%2Fonionoo.torproject.org%2Fdetails%3Ftype%3Drelay%26running%3D
Source: Payload 94.75.225.exeString found in binary or memory: https://onionoo.torproject.org/details?type=relay&running=true&fields=fingerprint
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: classification engineClassification label: mal48.winEXE@2/0@1/100
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2616:120:WilError_03
Source: C:\Users\user\Desktop\Payload 94.75.225.exeFile opened: C:\Windows\system32\bdad9b525372a60bb98dde1d5ec1eba66f5b4cfe6a7f91bf3e8e1dea2ba2e292AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJump to behavior
Source: Payload 94.75.225.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Payload 94.75.225.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Payload 94.75.225.exeString found in binary or memory: b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5fhttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil BodyNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher: the nonce can't have zero length, or the security of the key will be immediately compromisedcgocheck > 1 mode is no longer supported at runtime. Use GOEXPERIMENT=cgocheck2 at build time instead.asn1: time did not serialize back to the original value and may be invalid: given %q, but serialized as %qhttps://github.com/ValdikSS/tor-onionoo-mirror/raw/master/details-running-relays-fingerprint-address-only.jsonhttps://bitbucket.org/ValdikSS/tor-onionoo-mirror/raw/master/details-running-relays-fingerprint-address-only.jsonhttp2: Transport: cannot retry err [%v] after Request.Body was written; define Request.GetBody to avoid this error39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319394020061963944792122790401001436138050797392704654466679469052796276593991132635693989563081522949135544336539426430051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f0000c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd166506864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151686479766013060971498190079908139321726943530014330540939446345918554318339765539424505774633321719753296399637136332111386476861244038034037280889270700544900010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
Source: Payload 94.75.225.exeString found in binary or memory: /home/runner/go/pkg/mod/github.com/xo/terminfo@v0.0.0-20210125001918-ca9a967f8778/load.go
Source: Payload 94.75.225.exeString found in binary or memory: /opt/hostedtoolcache/go/1.21.5/x64/src/net/addrselect.go
Source: unknownProcess created: C:\Users\user\Desktop\Payload 94.75.225.exe "C:\Users\user\Desktop\Payload 94.75.225.exe"
Source: C:\Users\user\Desktop\Payload 94.75.225.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeSection loaded: gpapi.dllJump to behavior
Source: Payload 94.75.225.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: Payload 94.75.225.exeStatic file information: File size 6365184 > 1048576
Source: Payload 94.75.225.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x2b6400
Source: Payload 94.75.225.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2d9200
Source: Payload 94.75.225.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Payload 94.75.225.exeStatic PE information: section name: .xdata
Source: Payload 94.75.225.exeStatic PE information: section name: .symtab

Persistence and Installation Behavior

barindex
Installs new ROOT certificates
Source: C:\Users\user\Desktop\Payload 94.75.225.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOTJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Users\user\Desktop\Payload 94.75.225.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: Payload 94.75.225.exe, 00000000.00000002.2128233497.0000015522E7C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllVV
Source: C:\Users\user\Desktop\Payload 94.75.225.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		1
Install Root Certificate		OS Credential Dumping1
Query Registry		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Modify Registry		LSASS Memory1
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Standard Port		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account Manager2
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsInternet Connection DiscoverySSHKeylogging1
Ingress Tool Transfer		Scheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Payload 94.75.225.exe0%ReversingLabs
Payload 94.75.225.exe0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
onionoo.torproject.org0%VirustotalBrowse
s-part-0017.t-0009.t-msedge.net0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://github.com/ValdikSS/tor-onionoo-mirror/raw/master/details-running-relays-fingerprint-address0%VirustotalBrowse
https://icors.vercel.app/?flag0%VirustotalBrowse
https://onionoo.torproject.org/details?type=relay&running=true&fields=fingerprint0%VirustotalBrowse
https://onionoo.torproject.org/details?type=relay&running=true&fields=fingerprint,or_addresses0%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
onionoo.torproject.org
204.8.99.156
truefalseunknown
s-part-0017.t-0009.t-msedge.net
13.107.246.45
truefalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://onionoo.torproject.org/details?type=relay&running=true&fields=fingerprint,or_addressesfalseunknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://onionoo.torproject.org/details?type=relay&running=true&fields=fingerprintPayload 94.75.225.exefalseunknown
https://github.com/ValdikSS/tor-onionoo-mirror/raw/master/details-running-relays-fingerprint-addressPayload 94.75.225.exefalseunknown
https://icors.vercel.app/?https%3A%2F%2Fonionoo.torproject.org%2Fdetails%3Ftype%3Drelay%26running%3DPayload 94.75.225.exe, 00000000.00000002.2126488008.000000C000192000.00000004.00001000.00020000.00000000.sdmpfalse
    		unknown
    https://icors.vercel.app/?flagPayload 94.75.225.exefalseunknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    137.220.37.214
    		unknownUnited States
    		20473AS-CHOOPAUSfalse
    107.173.148.133
    		unknownUnited States
    		36352AS-COLOCROSSINGUSfalse
    209.127.117.90
    		unknownCanada
    		55286SERVER-MANIACAfalse
    137.74.5.135
    		unknownFrance
    		16276OVHFRfalse
    45.11.229.132
    		unknownGermany
    		397525ALPHAONE-ASUSfalse
    192.42.116.179
    		unknownNetherlands
    		1101IP-EEND-ASIP-EENDBVNLfalse
    85.10.205.56
    		unknownGermany
    		24940HETZNER-ASDEfalse
    185.227.82.15
    		unknownNetherlands
    		208258ACCESS2ITNLfalse
    23.184.48.13
    		unknownReserved
    		394656CPA-AS1USfalse
    23.88.72.105
    		unknownUnited States
    		18978ENZUINC-USfalse
    84.247.160.4
    		unknownNorway
    		29300AS-DIRECTCONNECTNOfalse
    83.11.190.165
    		unknownPoland
    		5617TPNETPLfalse
    185.220.101.48
    		unknownGermany
    		208294ASMKNLfalse
    207.127.91.1
    		unknownUnited States
    		14135NAVISITE-EAST-2USfalse
    68.8.241.30
    		unknownUnited States
    		22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
    185.220.101.206
    		unknownGermany
    		208294ASMKNLfalse
    209.127.245.250
    		unknownCanada
    		27163INTERACTIVE-BROKERS-CORPUSfalse
    185.220.101.204
    		unknownGermany
    		208294ASMKNLfalse
    202.61.196.212
    		unknownAustralia
    		4842TH-AS-APTianhaiInfoTechCNfalse
    185.220.101.201
    		unknownGermany
    		208294ASMKNLfalse
    95.211.205.138
    		unknownNetherlands
    		60781LEASEWEB-NL-AMS-01NetherlandsNLfalse
    23.154.177.2
    		unknownReserved
    		397270NETINF-PRIMARY-ASUSfalse
    68.134.176.234
    		unknownUnited States
    		701UUNETUSfalse
    81.201.202.101
    		unknownSwitzerland
    		25353BAR-ASGliserallee16CHfalse
    2.204.219.86
    		unknownGermany
    		3209VODANETInternationalIP-BackboneofVodafoneDEfalse
    88.80.26.2
    		unknownSweden
    		33837PRQ-AS________________________SEfalse
    178.142.134.20
    		unknownGermany
    		9145EWETELCloppenburgerStrasse310DEfalse
    185.220.101.30
    		unknownGermany
    		208294ASMKNLfalse
    185.220.101.35
    		unknownGermany
    		208294ASMKNLfalse
    20.224.145.181
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    185.220.100.253
    		unknownGermany
    		205100F3NETZEDEfalse
    45.141.215.95
    		unknownNetherlands
    		62068SPECTRAIPSpectraIPBVNLfalse
    95.111.230.178
    		unknownUkraine
    		51167CONTABODEfalse
    95.216.33.58
    		unknownGermany
    		24940HETZNER-ASDEfalse
    5.39.185.164
    		unknownNetherlands
    		58291COLOCENTERNLfalse
    51.68.155.147
    		unknownFrance
    		16276OVHFRfalse
    5.161.247.161
    		unknownGermany
    		24940HETZNER-ASDEfalse
    188.165.194.209
    		unknownFrance
    		16276OVHFRfalse
    75.119.135.230
    		unknownUnited States
    		13645BROADBANDONEUSfalse
    57.128.180.74
    		unknownBelgium
    		2686ATGS-MMD-ASUSfalse
    94.26.73.162
    		unknownUnited States
    		40244TURNKEY-INTERNETUSfalse
    82.64.150.101
    		unknownFrance
    		12322PROXADFRfalse
    103.252.90.217
    		unknownGermany
    		59592BACKBONE-ASDEfalse
    84.247.178.134
    		unknownNorway
    		29300AS-DIRECTCONNECTNOfalse
    190.211.254.192
    		unknownPanama
    		51852PLI-ASCHfalse
    65.21.98.72
    		unknownUnited States
    		199592CP-ASDEfalse
    185.183.194.90
    		unknownSwitzerland
    		13030INIT7CHfalse
    178.79.154.219
    		unknownUnited Kingdom
    		63949LINODE-APLinodeLLCUSfalse
    162.247.74.202
    		unknownUnited States
    		4224CALYX-ASUSfalse
    15.204.143.192
    		unknownUnited States
    		71HP-INTERNET-ASUSfalse
    162.247.74.200
    		unknownUnited States
    		4224CALYX-ASUSfalse
    185.220.101.50
    		unknownGermany
    		208294ASMKNLfalse
    46.38.233.211
    		unknownGermany
    		197540NETCUP-ASnetcupGmbHDEfalse
    95.99.30.188
    		unknownNetherlands
    		31615TMO-NL-ASNLfalse
    136.35.138.88
    		unknownUnited States
    		16591GOOGLE-FIBERUSfalse
    71.163.253.207
    		unknownUnited States
    		701UUNETUSfalse
    85.90.207.39
    		unknownUkraine
    		34248VELTON-TC-ASKharkovUkraineUAfalse
    185.40.4.95
    		unknownRussian Federation
    		50113SUPERSERVERSDATACENTERRUfalse
    129.151.198.94
    		unknownUnited States
    		4192STORTEK-INTUSfalse
    193.239.86.133
    		unknownRomania
    		35215MERITAPLfalse
    198.24.164.98
    		unknownUnited States
    		19437SS-ASHUSfalse
    162.247.74.31
    		unknownUnited States
    		4224CALYX-ASUSfalse
    23.163.200.46
    		unknownReserved
    		62969ABCCOMMCAfalse
    45.89.54.11
    		unknownRussian Federation
    		44676VMAGE-ASRUfalse
    178.63.41.183
    		unknownGermany
    		24940HETZNER-ASDEfalse
    204.8.99.156
    		onionoo.torproject.orgUnited States
    		22581ACE-STXVIfalse
    109.70.100.71
    		unknownAustria
    		208323APPLIEDPRIVACY-ASATfalse
    45.148.17.56
    		unknownSweden
    		197595OBE-EUROPEObenetworkEuropeSEfalse
    194.88.105.30
    		unknownNetherlands
    		49981WORLDSTREAMNLfalse
    51.195.119.159
    		unknownFrance
    		16276OVHFRfalse
    31.220.72.103
    		unknownSpain
    		16372OWSESfalse
    152.53.111.174
    		unknownUnited States
    		81NCRENUSfalse
    70.39.91.101
    		unknownUnited States
    		46844ST-BGPUSfalse
    152.67.112.12
    		unknownUnited States
    		31898ORACLE-BMC-31898USfalse
    138.68.9.184
    		unknownUnited States
    		14061DIGITALOCEAN-ASNUSfalse
    67.219.107.200
    		unknownUnited States
    		19529RAZOR-PHLUSfalse
    37.114.57.182
    		unknownGermany
    		12586ASGHOSTNETDEfalse
    45.138.16.107
    		unknownNetherlands
    		62068SPECTRAIPSpectraIPBVNLfalse
    209.141.47.207
    		unknownUnited States
    		53667PONYNETUSfalse
    45.141.215.4
    		unknownNetherlands
    		62068SPECTRAIPSpectraIPBVNLfalse
    87.98.243.204
    		unknownFrance
    		16276OVHFRfalse
    172.114.8.83
    		unknownUnited States
    		20001TWC-20001-PACWESTUSfalse
    161.97.132.254
    		unknownUnited States
    		51167CONTABODEfalse
    109.70.100.3
    		unknownAustria
    		208323APPLIEDPRIVACY-ASATfalse
    185.129.61.3
    		unknownDenmark
    		57860ZENCURITY-NETDKfalse
    95.148.2.122
    		unknownUnited Kingdom
    		12576EELtdGBfalse
    192.42.116.195
    		unknownNetherlands
    		1101IP-EEND-ASIP-EENDBVNLfalse
    168.181.185.147
    		unknownArgentina
    		27823DattateccomARfalse
    204.8.96.112
    		unknownUnited States
    		22581ACE-STXVIfalse
    185.107.57.64
    		unknownNetherlands
    		43350NFORCENLfalse
    194.164.16.95
    		unknownUnited Kingdom
    		8897KCOM-SPNService-ProviderNetworkex-MistralGBfalse
    185.220.101.21
    		unknownGermany
    		208294ASMKNLfalse
    50.230.231.85
    		unknownUnited States
    		7922COMCAST-7922USfalse
    107.189.12.88
    		unknownUnited States
    		53667PONYNETUSfalse
    51.81.56.136
    		unknownUnited States
    		16276OVHFRfalse
    153.120.42.137
    		unknownJapan7684SAKURA-ASAKURAInternetIncJPfalse
    80.92.204.251
    		unknownRussian Federation
    		21240HELIOSNET-ASRUfalse
    45.141.215.61
    		unknownNetherlands
    		62068SPECTRAIPSpectraIPBVNLfalse
    192.42.116.189
    		unknownNetherlands
    		1101IP-EEND-ASIP-EENDBVNLfalse
    185.241.208.71
    		unknownMoldova Republic of
    		26636GBTCLOUDUSfalse

    General Information

    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1547867
    Start date and time:2024-11-03 09:34:11 +01:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 2m 36s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:3
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:Payload 94.75.225.exe
    Detection:MAL
    Classification:mal48.winEXE@2/0@1/100
    EGA Information:Failed
    HCA Information:Failed
    Cookbook Comments:
    • Found application associated with file extension: .exe
    • Stop behavior analysis, all processes terminated

    Warnings

    • Exclude process from analysis (whitelisted): dllhost.exe
    • Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
    • Execution Graph export aborted for target Payload 94.75.225.exe, PID 6708 because it is empty
    • Not all processes where analyzed, report is missing behavior information
    • Report size getting too big, too many NtDeviceIoControlFile calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.
    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    185.220.101.206Mcb5K3TOWT.exeGet hashmaliciousUnknownBrowse
      KWwpSm0Cec.exeGet hashmaliciousLummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, VidarBrowse
        MCYq2AqNU0.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
          IIBXMzS0zN.exeGet hashmaliciousGlupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
            aif31Spjyi.exeGet hashmaliciousGlupteba, SmokeLoaderBrowse
              82YWwkVfIS.exeGet hashmaliciousGlupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoaderBrowse
                file.exeGet hashmaliciousUnknownBrowse
                  g5oo6DQ4pd.exeGet hashmaliciousUnknownBrowse
                    puzykxm8rg.exeGet hashmaliciousAmadey, RedLine, SmokeLoaderBrowse
                      23.154.177.2fK5LTFDKXC.exeGet hashmaliciousKronosBrowse
                      • 23.154.177.2/tor/server/fp/856fff1a581da7b4db81f2bf21ef2c82b2c97841
                      185.220.101.204906o5yr1NE.exeGet hashmaliciousLummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                        Zxf5vHRSrw.exeGet hashmaliciousBazaLoaderBrowse
                          KJN55hQKh2.exeGet hashmaliciousPhorpiex XmrigBrowse
                            185.220.101.201A2G6pO40qG.exeGet hashmaliciousCMSBruteBrowse

                              Domains

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              s-part-0017.t-0009.t-msedge.netfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                              • 13.107.246.45
                              https://alerts.redeem.myrewardsaccess.com/H/2/v600000192eeba5095b7d0656e96c660f0/a6ca8bf7-2895-4560-b8c8-c42904590ea4/HTMLGet hashmaliciousUnknownBrowse
                              • 13.107.246.45
                              CDT.ps1Get hashmaliciousAsyncRATBrowse
                              • 13.107.246.45
                              VsXpA6fSbk.jsGet hashmaliciousUnknownBrowse
                              • 13.107.246.45
                              file.exeGet hashmaliciousUnknownBrowse
                              • 13.107.246.45
                              file.exeGet hashmaliciousUnknownBrowse
                              • 13.107.246.45
                              file.exeGet hashmaliciousUnknownBrowse
                              • 13.107.246.45
                              file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                              • 13.107.246.45
                              SecuriteInfo.com.Win64.CrypterX-gen.2448.5331.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                              • 13.107.246.45
                              https://studla.b-cdn.net/mine/carted/delta/chaloos.zipGet hashmaliciousLummaCBrowse
                              • 13.107.246.45

                              ASNs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              AS-COLOCROSSINGUSNew_Order_#070824_Order_November-2024-pdf.exeGet hashmaliciousRemcosBrowse
                              • 198.46.178.148
                              Warm_UP.rtfGet hashmaliciousUnknownBrowse
                              • 107.172.130.147
                              greatthingswithmegoods.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                              • 198.46.178.151
                              seethebestthingswithgreatthingshrewithme.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                              • 107.175.130.36
                              creatednewthingsformee.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                              • 198.46.178.151
                              A & C Metrology OC 545714677889Materiale.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                              • 107.175.130.20
                              http://xn--gba7iaacaabba0ab51nca04ecacdad9203oearjjb191bfa.mkto-sj030022.comGet hashmaliciousUnknownBrowse
                              • 192.3.96.254
                              greatthingswithmegood.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                              • 198.46.178.151
                              Orden de Compra.xlam.xlsxGet hashmaliciousUnknownBrowse
                              • 192.3.220.20
                              PO.2407010.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                              • 198.46.178.151
                              OVHFR4GPlus.batGet hashmaliciousUnknownBrowse
                              • 51.195.251.11
                              Reservation Detail Booking.com ID4336.vbsGet hashmaliciousAsyncRAT, PureLog Stealer, zgRATBrowse
                              • 94.23.17.185
                              aba.batGet hashmaliciousUnknownBrowse
                              • 51.195.251.11
                              park.batGet hashmaliciousUnknownBrowse
                              • 51.195.251.11
                              ICBM.exeGet hashmaliciousXmrigBrowse
                              • 51.210.150.92
                              nuklear.arm.elfGet hashmaliciousMiraiBrowse
                              • 198.27.68.52
                              debug.dbg.elfGet hashmaliciousGafgyt, MiraiBrowse
                              • 178.32.95.205
                              ICBM.exeGet hashmaliciousXmrigBrowse
                              • 51.195.138.197
                              ICBM.exeGet hashmaliciousXmrigBrowse
                              • 51.195.43.17
                              D4FX3QYunY.exeGet hashmaliciousDarkVision RatBrowse
                              • 144.217.96.196
                              AS-CHOOPAUSsh4.elfGet hashmaliciousMiraiBrowse
                              • 45.63.53.226
                              Setup.exeGet hashmaliciousUnknownBrowse
                              • 207.246.91.177
                              Setup.exeGet hashmaliciousUnknownBrowse
                              • 207.246.91.177
                              https://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                              • 45.32.1.23
                              createbestthingswithmegoodthingswithgoodthings.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                              • 66.42.65.6
                              Setup.exeGet hashmaliciousUnknownBrowse
                              • 45.32.1.23
                              Setup.exeGet hashmaliciousUnknownBrowse
                              • 207.246.91.177
                              wZU2edEGL3.elfGet hashmaliciousUnknownBrowse
                              • 204.80.129.14
                              belks.spc.elfGet hashmaliciousMiraiBrowse
                              • 95.179.203.61
                              jew.arm.elfGet hashmaliciousUnknownBrowse
                              • 66.42.126.74
                              SERVER-MANIACAla.bot.sparc.elfGet hashmaliciousUnknownBrowse
                              • 104.227.93.164
                              la.bot.powerpc.elfGet hashmaliciousUnknownBrowse
                              • 107.152.158.164
                              i586.elfGet hashmaliciousMiraiBrowse
                              • 104.144.70.38
                              na.elfGet hashmaliciousMiraiBrowse
                              • 104.144.232.206
                              na.elfGet hashmaliciousUnknownBrowse
                              • 23.229.36.224
                              na.elfGet hashmaliciousMiraiBrowse
                              • 23.250.5.197
                              jade.spc.elfGet hashmaliciousMiraiBrowse
                              • 23.229.36.239
                              http://ugwebstore.comGet hashmaliciousUnknownBrowse
                              • 192.157.56.142
                              sh4.elfGet hashmaliciousUnknownBrowse
                              • 104.144.21.94
                              pUBl5tg90v.exeGet hashmaliciousAgentTeslaBrowse
                              • 209.127.20.21

                              JA3 Fingerprints

                              ⊘No context

                              Dropped Files

                              ⊘No context

                              Created / dropped Files

                              ⊘No created / dropped files found

                              Static File Info

                              General

                              File type:PE32+ executable (console) x86-64, for MS Windows
                              Entropy (8bit):6.182038544986381
                              TrID:
                              • Win64 Executable Console (202006/5) 92.65%
                              • Win64 Executable (generic) (12005/4) 5.51%
                              • Generic Win/DOS Executable (2004/3) 0.92%
                              • DOS Executable Generic (2002/1) 0.92%
                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                              File name:Payload 94.75.225.exe
                              File size:6'365'184 bytes
                              MD5:c1cd02403f4ca49c8547b397dad11a21
                              SHA1:cee43976d68fb7f56af41e1bcfb42227a6e6e225
                              SHA256:69e7acf427dbfc86650bd4dad8c97c399a5c921cb1b8cca5dfc7b4a53d849ca0
                              SHA512:b457d625e7929786ed8f6ce8e416085cf095ac73fbdbfef676d907916ca6ad50c7be3efc35241f4477cabe6766ebfcae607f74cc09fb7f3271c2b60ff0c4f302
                              SSDEEP:49152:k0qABj4dbqWdAfj3HW3PlTx50y4ND8pe8wf29nrQm80XSGYja5ErDMATCqgQdWGT:u0pmNjpe1snEbUiWWXZ
                              TLSH:66563947FCA441E4C4ADA6318A769262BB717C484B3123D33B50F7382F76BD0AA7A754
                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........a......."......d+..4...... .........@..............................@g...........`... ............................

                              File Icon

                              Icon Hash:00928e8e8686b000

                              Static PE Info

                              General

                              Entrypoint:0x468420
                              Entrypoint Section:.text
                              Digitally signed:false
                              Imagebase:0x400000
                              Subsystem:windows cui
                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                              DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                              Time Stamp:0x0 [Thu Jan 1 00:00:00 1970 UTC]
                              TLS Callbacks:
                              CLR (.Net) Version:
                              OS Version Major:6
                              OS Version Minor:1
                              File Version Major:6
                              File Version Minor:1
                              Subsystem Version Major:6
                              Subsystem Version Minor:1
                              Import Hash:4f2f006e2ecf7172ad368f8289dc96c1

                              Entrypoint Preview

                              Instruction
                              jmp 00007F4F410DA3E0h
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              pushfd
                              cld
                              dec eax
                              sub esp, 000000E0h
                              dec eax
                              mov dword ptr [esp], edi
                              dec eax
                              mov dword ptr [esp+08h], esi
                              dec eax
                              mov dword ptr [esp+10h], ebp
                              dec eax
                              mov dword ptr [esp+18h], ebx
                              dec esp
                              mov dword ptr [esp+20h], esp
                              dec esp
                              mov dword ptr [esp+28h], ebp
                              dec esp
                              mov dword ptr [esp+30h], esi
                              dec esp
                              mov dword ptr [esp+38h], edi
                              movups dqword ptr [esp+40h], xmm6
                              movups dqword ptr [esp+50h], xmm7
                              inc esp
                              movups dqword ptr [esp+60h], xmm0
                              inc esp
                              movups dqword ptr [esp+70h], xmm1
                              inc esp
                              movups dqword ptr [esp+00000080h], xmm2
                              inc esp
                              movups dqword ptr [esp+00000090h], xmm3
                              inc esp
                              movups dqword ptr [esp+000000A0h], xmm4
                              inc esp
                              movups dqword ptr [esp+000000B0h], xmm5
                              inc esp
                              movups dqword ptr [esp+000000C0h], xmm6
                              inc esp
                              movups dqword ptr [esp+000000D0h], xmm7
                              inc ebp
                              xorps xmm7, xmm7
                              dec ebp
                              xor esi, esi
                              dec eax
                              mov eax, dword ptr [005E2AEEh]
                              dec eax
                              mov eax, dword ptr [eax]
                              dec eax
                              cmp eax, 00000000h
                              je 00007F4F410DDCE5h
                              dec esp
                              mov esi, dword ptr [eax]
                              dec eax
                              sub esp, 10h
                              dec eax
                              mov eax, ecx
                              dec eax
                              mov ebx, edx
                              call 00007F4F410C04DFh
                              dec eax

                              Data Directories

                              NameVirtual AddressVirtual Size Is in Section
                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IMPORT0x6640000x516.idata
                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x6520000x10848.pdata
                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x6650000xdbac.reloc
                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IAT0x5928400x170.data
                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                              Sections

                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                              .text0x10000x2b63b40x2b64003c953c828b96e37f66cdfd3cc865b389unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              .rdata0x2b80000x2d90580x2d920017ca041790a3a9447eb79a4913782771unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .data0x5920000xbf9b00x63400d8299e45d12855dd17c8457696fb9fcaFalse0.3247549984256927data4.210385800855117IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                              .pdata0x6520000x108480x10a0006e4bbd359bd569b71948ff987c618f8False0.39812911184210525data5.472628714520099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .xdata0x6630000xa80x2002a5152ffc3a52ca1d276acd572c41b9aFalse0.19921875shared library1.6345075234569126IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .idata0x6640000x5160x600ed2f474267862dceaeb8cdc37e7887fcFalse0.3639322916666667data3.8700139346555313IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                              .reloc0x6650000xdbac0xdc0062f9a2ba71eb294bd994ea6410e003d5False0.24170809659090908data5.443640473880409IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                              .symtab0x6730000x40x20007b5472d347d42780469fb2654b7fc54False0.02734375data0.020393135236084953IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                              Imports

                              DLLImport
                              kernel32.dllWriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

                              Network Behavior

                              Network Port Distribution

                              TCP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              Nov 3, 2024 09:35:02.735732079 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:02.735760927 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:02.735826969 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:02.736196995 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:02.736208916 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.570758104 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.575566053 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.575581074 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.575829983 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.575834990 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.577295065 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.577368021 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.650505066 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.650610924 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.650609970 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.695334911 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.698158979 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.698167086 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.746592999 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.895766973 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.895816088 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.895824909 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.895848989 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.895870924 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.895872116 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.895879030 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.895910025 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.895926952 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.895956993 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.987236023 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.987250090 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.987279892 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.987330914 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.987339020 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:03.987370968 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:03.987389088 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.043764114 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.043787956 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.043898106 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.043908119 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.043977976 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.133114100 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.133136988 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.133188009 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.133197069 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.133248091 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.134900093 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.134915113 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.134973049 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.134979963 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.135020018 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.136727095 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.136740923 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.136795998 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.136802912 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.136851072 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.192121029 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.192137957 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.192210913 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.192219019 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.192264080 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.282377005 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.282401085 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.282525063 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.282535076 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.282576084 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.283449888 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.283467054 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.283503056 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.283509970 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.283535957 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.283550024 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.284853935 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.284868956 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.284943104 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.284950018 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.284982920 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.285906076 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.285921097 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.285958052 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.285964966 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.285988092 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.286006927 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.286902905 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.286920071 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.286958933 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.286966085 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.286989927 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.287008047 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.287808895 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.287823915 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.287867069 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.287873983 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.287911892 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.347661972 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.347677946 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.347790003 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.347800970 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.347811937 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.347831011 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.347845078 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.347851038 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.347876072 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.347903967 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.429289103 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.429311037 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.429372072 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.429382086 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.429409027 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.429430962 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.429678917 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.429694891 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.429749966 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.429758072 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.429794073 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.430537939 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.430552959 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.430600882 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.430608034 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.430646896 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.430982113 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.430998087 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.431062937 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.431070089 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.431106091 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.431540966 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.431555986 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.431595087 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.431602001 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.431637049 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.431648970 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.431983948 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.432388067 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.432404041 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.432456970 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.432462931 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.432498932 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.432619095 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.432638884 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.432679892 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.432687044 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.432708025 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.432715893 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.433470964 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.433486938 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.433527946 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.433535099 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.433572054 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.434163094 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.434180021 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.434226990 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.434235096 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.434273005 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.434415102 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.434428930 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.434462070 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.434468031 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.434493065 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.434510946 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.435375929 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.435391903 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.435432911 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.435440063 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.435460091 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.435480118 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.436431885 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.436444998 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.436492920 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.436500072 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.436538935 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.440967083 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.485706091 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.485740900 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.485788107 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.485827923 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.485831976 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.485847950 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.485898972 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.485938072 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.485953093 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.485996008 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.486002922 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.486277103 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.486295938 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.486329079 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.486336946 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.486370087 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.491833925 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.491847992 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.491918087 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.491926908 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.545849085 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.576247931 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576266050 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576320887 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576342106 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.576350927 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576390982 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.576421976 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.576641083 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576659918 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576709032 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.576714993 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576735020 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576752901 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576780081 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.576786995 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.576798916 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.581273079 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581294060 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581347942 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.581356049 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581501961 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581532955 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581558943 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.581566095 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581589937 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.581734896 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581749916 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581794024 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.581800938 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581928968 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581952095 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.581980944 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.581988096 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582015038 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582287073 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582300901 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582349062 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582355976 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582387924 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582423925 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582442999 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582483053 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582489014 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582494974 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582515001 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582528114 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582547903 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582555056 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582577944 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582602978 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582691908 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582706928 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582753897 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.582760096 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.582806110 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583239079 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583256006 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583329916 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583337069 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583369970 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583512068 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583527088 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583573103 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583579063 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583595991 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583630085 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583632946 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583650112 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583653927 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583688021 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583846092 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583859921 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583904028 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.583910942 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.583955050 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584109068 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584135056 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584177017 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584182978 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584213018 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584213018 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584341049 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584355116 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584399939 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584405899 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584446907 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584481955 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584496021 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584531069 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584536076 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584563971 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584570885 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584645987 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584667921 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584717035 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.584726095 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.584763050 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.585140944 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585155010 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585200071 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.585206032 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585241079 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.585278988 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585293055 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585331917 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.585336924 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585347891 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585366011 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585376024 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.585381031 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.585407972 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.585433006 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.632863045 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.632879972 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.632937908 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.632966042 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.632971048 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.632991076 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.633004904 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.633044004 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.633052111 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.633069992 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.633090973 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.633127928 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.633253098 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.633265018 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.633291960 CET49708443192.168.2.6204.8.99.156
                              Nov 3, 2024 09:35:04.633296967 CET44349708204.8.99.156192.168.2.6
                              Nov 3, 2024 09:35:04.767601013 CET4971010443192.168.2.6185.40.4.95
                              Nov 3, 2024 09:35:04.767739058 CET49711443192.168.2.6185.107.57.64
                              Nov 3, 2024 09:35:04.767772913 CET44349711185.107.57.64192.168.2.6
                              Nov 3, 2024 09:35:04.767842054 CET49711443192.168.2.6185.107.57.64
                              Nov 3, 2024 09:35:04.767945051 CET49712443192.168.2.6185.220.101.201
                              Nov 3, 2024 09:35:04.767961979 CET44349712185.220.101.201192.168.2.6
                              Nov 3, 2024 09:35:04.768007994 CET49712443192.168.2.6185.220.101.201
                              Nov 3, 2024 09:35:04.768101931 CET497139001192.168.2.62.204.219.86
                              Nov 3, 2024 09:35:04.768229961 CET497149000192.168.2.6185.241.208.71
                              Nov 3, 2024 09:35:04.768352032 CET49715443192.168.2.6185.220.101.204
                              Nov 3, 2024 09:35:04.768392086 CET44349715185.220.101.204192.168.2.6
                              Nov 3, 2024 09:35:04.768440008 CET49715443192.168.2.6185.220.101.204
                              Nov 3, 2024 09:35:04.768507957 CET497169001192.168.2.6107.173.148.133
                              Nov 3, 2024 09:35:04.768616915 CET497179002192.168.2.6192.42.116.179
                              Nov 3, 2024 09:35:04.768737078 CET497189001192.168.2.695.99.30.188
                              Nov 3, 2024 09:35:04.768846989 CET4971930443192.168.2.651.195.119.159
                              Nov 3, 2024 09:35:04.768963099 CET49720443192.168.2.695.111.230.178
                              Nov 3, 2024 09:35:04.768970966 CET4434972095.111.230.178192.168.2.6
                              Nov 3, 2024 09:35:04.769016027 CET49720443192.168.2.695.111.230.178
                              Nov 3, 2024 09:35:04.769104958 CET497218430192.168.2.645.141.215.95
                              Nov 3, 2024 09:35:04.769242048 CET49722443192.168.2.667.219.107.200
                              Nov 3, 2024 09:35:04.769270897 CET4434972267.219.107.200192.168.2.6
                              Nov 3, 2024 09:35:04.769321918 CET49722443192.168.2.667.219.107.200
                              Nov 3, 2024 09:35:04.769386053 CET497239021192.168.2.6207.127.91.1
                              Nov 3, 2024 09:35:04.769534111 CET4972415259192.168.2.6185.227.82.15
                              Nov 3, 2024 09:35:04.769675016 CET49725443192.168.2.6109.70.100.3
                              Nov 3, 2024 09:35:04.769701958 CET44349725109.70.100.3192.168.2.6
                              Nov 3, 2024 09:35:04.769752026 CET49725443192.168.2.6109.70.100.3
                              Nov 3, 2024 09:35:04.772505045 CET1044349710185.40.4.95192.168.2.6
                              Nov 3, 2024 09:35:04.772558928 CET4971010443192.168.2.6185.40.4.95
                              Nov 3, 2024 09:35:04.772941113 CET9001497132.204.219.86192.168.2.6
                              Nov 3, 2024 09:35:04.772988081 CET497139001192.168.2.62.204.219.86
                              Nov 3, 2024 09:35:04.773034096 CET900049714185.241.208.71192.168.2.6
                              Nov 3, 2024 09:35:04.773077011 CET497149000192.168.2.6185.241.208.71
                              Nov 3, 2024 09:35:04.773442030 CET900149716107.173.148.133192.168.2.6
                              Nov 3, 2024 09:35:04.773483992 CET497169001192.168.2.6107.173.148.133
                              Nov 3, 2024 09:35:04.773514032 CET900249717192.42.116.179192.168.2.6
                              Nov 3, 2024 09:35:04.773529053 CET90014971895.99.30.188192.168.2.6
                              Nov 3, 2024 09:35:04.773561954 CET497179002192.168.2.6192.42.116.179
                              Nov 3, 2024 09:35:04.773585081 CET497189001192.168.2.695.99.30.188
                              Nov 3, 2024 09:35:04.773634911 CET304434971951.195.119.159192.168.2.6
                              Nov 3, 2024 09:35:04.773682117 CET4971930443192.168.2.651.195.119.159
                              Nov 3, 2024 09:35:04.773916960 CET84304972145.141.215.95192.168.2.6
                              Nov 3, 2024 09:35:04.773962975 CET497218430192.168.2.645.141.215.95
                              Nov 3, 2024 09:35:04.774183035 CET902149723207.127.91.1192.168.2.6
                              Nov 3, 2024 09:35:04.774228096 CET497239021192.168.2.6207.127.91.1
                              Nov 3, 2024 09:35:04.774352074 CET1525949724185.227.82.15192.168.2.6
                              Nov 3, 2024 09:35:04.774427891 CET4972415259192.168.2.6185.227.82.15
                              Nov 3, 2024 09:35:04.774506092 CET497269005192.168.2.6109.70.100.71
                              Nov 3, 2024 09:35:04.776001930 CET497279001192.168.2.645.11.229.132
                              Nov 3, 2024 09:35:04.776171923 CET497289001192.168.2.6138.68.9.184
                              Nov 3, 2024 09:35:04.776320934 CET49729110192.168.2.6153.120.42.137
                              Nov 3, 2024 09:35:04.776437044 CET497309000192.168.2.687.98.243.204
                              Nov 3, 2024 09:35:04.776571989 CET497319001192.168.2.6194.164.16.95
                              Nov 3, 2024 09:35:04.776689053 CET49732443192.168.2.6185.183.194.90
                              Nov 3, 2024 09:35:04.776695967 CET44349732185.183.194.90192.168.2.6
                              Nov 3, 2024 09:35:04.776751041 CET49732443192.168.2.6185.183.194.90
                              Nov 3, 2024 09:35:04.776823044 CET497339000192.168.2.6192.42.116.189
                              Nov 3, 2024 09:35:04.777019978 CET497341004192.168.2.6209.127.117.90
                              Nov 3, 2024 09:35:04.777158022 CET49735443192.168.2.620.224.145.181
                              Nov 3, 2024 09:35:04.777165890 CET4434973520.224.145.181192.168.2.6
                              Nov 3, 2024 09:35:04.777213097 CET49735443192.168.2.620.224.145.181
                              Nov 3, 2024 09:35:04.777298927 CET49736443192.168.2.657.128.180.74
                              Nov 3, 2024 09:35:04.777307987 CET4434973657.128.180.74192.168.2.6
                              Nov 3, 2024 09:35:04.777352095 CET49736443192.168.2.657.128.180.74
                              Nov 3, 2024 09:35:04.777441025 CET497371003192.168.2.685.10.205.56
                              Nov 3, 2024 09:35:04.777539015 CET49738443192.168.2.685.90.207.39
                              Nov 3, 2024 09:35:04.777544975 CET4434973885.90.207.39192.168.2.6
                              Nov 3, 2024 09:35:04.777594090 CET49738443192.168.2.685.90.207.39
                              Nov 3, 2024 09:35:04.777682066 CET497399100192.168.2.6185.220.100.253
                              Nov 3, 2024 09:35:04.777793884 CET49740443192.168.2.651.81.56.136
                              Nov 3, 2024 09:35:04.777801037 CET4434974051.81.56.136192.168.2.6
                              Nov 3, 2024 09:35:04.777843952 CET49740443192.168.2.651.81.56.136
                              Nov 3, 2024 09:35:04.777928114 CET497419001192.168.2.6193.239.86.133
                              Nov 3, 2024 09:35:04.779000998 CET49742443192.168.2.623.154.177.2
                              Nov 3, 2024 09:35:04.779015064 CET4434974223.154.177.2192.168.2.6
                              Nov 3, 2024 09:35:04.779072046 CET49742443192.168.2.623.154.177.2
                              Nov 3, 2024 09:35:04.779195070 CET497438443192.168.2.6185.220.101.206
                              Nov 3, 2024 09:35:04.779292107 CET900549726109.70.100.71192.168.2.6
                              Nov 3, 2024 09:35:04.779310942 CET497449001192.168.2.6202.61.196.212
                              Nov 3, 2024 09:35:04.779356956 CET497269005192.168.2.6109.70.100.71
                              Nov 3, 2024 09:35:04.779515028 CET497459001192.168.2.680.92.204.251
                              Nov 3, 2024 09:35:04.779628038 CET497469088192.168.2.6152.53.111.174
                              Nov 3, 2024 09:35:04.779957056 CET49747443192.168.2.6152.67.112.12
                              Nov 3, 2024 09:35:04.779973984 CET44349747152.67.112.12192.168.2.6
                              Nov 3, 2024 09:35:04.780026913 CET49747443192.168.2.6152.67.112.12
                              Nov 3, 2024 09:35:04.780481100 CET497499001192.168.2.688.80.26.2
                              Nov 3, 2024 09:35:04.780525923 CET497509001192.168.2.637.114.57.182
                              Nov 3, 2024 09:35:04.780677080 CET497519300192.168.2.657.129.44.38
                              Nov 3, 2024 09:35:04.780766964 CET4975232616192.168.2.694.131.171.105
                              Nov 3, 2024 09:35:04.780838966 CET49753445192.168.2.6137.74.5.135
                              Nov 3, 2024 09:35:04.780945063 CET497549002192.168.2.684.247.178.134
                              Nov 3, 2024 09:35:04.780986071 CET90014972745.11.229.132192.168.2.6
                              Nov 3, 2024 09:35:04.781040907 CET497279001192.168.2.645.11.229.132
                              Nov 3, 2024 09:35:04.781086922 CET4975561040192.168.2.631.220.72.103
                              Nov 3, 2024 09:35:04.781095028 CET900149728138.68.9.184192.168.2.6
                              Nov 3, 2024 09:35:04.781145096 CET497289001192.168.2.6138.68.9.184
                              Nov 3, 2024 09:35:04.781191111 CET497569001192.168.2.6178.142.134.20
                              Nov 3, 2024 09:35:04.781256914 CET11049729153.120.42.137192.168.2.6
                              Nov 3, 2024 09:35:04.781311035 CET49729110192.168.2.6153.120.42.137
                              Nov 3, 2024 09:35:04.781333923 CET497579001192.168.2.682.64.150.101
                              Nov 3, 2024 09:35:04.781341076 CET90004973087.98.243.204192.168.2.6
                              Nov 3, 2024 09:35:04.781383991 CET497309000192.168.2.687.98.243.204
                              Nov 3, 2024 09:35:04.781434059 CET497599002192.168.2.6185.220.101.30
                              Nov 3, 2024 09:35:04.781512976 CET497489001192.168.2.6107.189.12.88
                              Nov 3, 2024 09:35:04.781538010 CET497609001192.168.2.675.119.135.230
                              Nov 3, 2024 09:35:04.781550884 CET900149731194.164.16.95192.168.2.6
                              Nov 3, 2024 09:35:04.781594992 CET497319001192.168.2.6194.164.16.95
                              Nov 3, 2024 09:35:04.781646967 CET497619000192.168.2.6209.127.245.250
                              Nov 3, 2024 09:35:04.781785011 CET497629200192.168.2.6103.252.90.217
                              Nov 3, 2024 09:35:04.781810045 CET900049733192.42.116.189192.168.2.6
                              Nov 3, 2024 09:35:04.781837940 CET497589001192.168.2.668.8.241.30
                              Nov 3, 2024 09:35:04.781857014 CET497339000192.168.2.6192.42.116.189
                              Nov 3, 2024 09:35:04.782012939 CET100449734209.127.117.90192.168.2.6
                              Nov 3, 2024 09:35:04.782063007 CET497341004192.168.2.6209.127.117.90
                              Nov 3, 2024 09:35:04.782252073 CET49763443192.168.2.683.11.190.165
                              Nov 3, 2024 09:35:04.782259941 CET4434976383.11.190.165192.168.2.6
                              Nov 3, 2024 09:35:04.782305002 CET49763443192.168.2.683.11.190.165
                              Nov 3, 2024 09:35:04.782413006 CET49764443192.168.2.695.211.205.138
                              Nov 3, 2024 09:35:04.782421112 CET4434976495.211.205.138192.168.2.6
                              Nov 3, 2024 09:35:04.782471895 CET49764443192.168.2.695.211.205.138
                              Nov 3, 2024 09:35:04.782494068 CET497659001192.168.2.6188.165.194.209
                              Nov 3, 2024 09:35:04.782613993 CET49766443192.168.2.6198.24.164.98
                              Nov 3, 2024 09:35:04.782620907 CET44349766198.24.164.98192.168.2.6
                              Nov 3, 2024 09:35:04.782640934 CET10034973785.10.205.56192.168.2.6
                              Nov 3, 2024 09:35:04.782672882 CET49766443192.168.2.6198.24.164.98
                              Nov 3, 2024 09:35:04.782691956 CET497371003192.168.2.685.10.205.56
                              Nov 3, 2024 09:35:04.782731056 CET497679001192.168.2.6185.220.101.21
                              Nov 3, 2024 09:35:04.782826900 CET49768443192.168.2.646.38.233.211
                              Nov 3, 2024 09:35:04.782834053 CET4434976846.38.233.211192.168.2.6
                              Nov 3, 2024 09:35:04.782869101 CET910049739185.220.100.253192.168.2.6
                              Nov 3, 2024 09:35:04.782882929 CET49768443192.168.2.646.38.233.211
                              Nov 3, 2024 09:35:04.782910109 CET497399100192.168.2.6185.220.100.253
                              Nov 3, 2024 09:35:04.782932997 CET497698430192.168.2.645.141.215.61
                              Nov 3, 2024 09:35:04.783036947 CET497709001192.168.2.623.184.48.13
                              Nov 3, 2024 09:35:04.783112049 CET900149741193.239.86.133192.168.2.6
                              Nov 3, 2024 09:35:04.783154011 CET497719000192.168.2.623.163.200.46
                              Nov 3, 2024 09:35:04.783260107 CET497419001192.168.2.6193.239.86.133
                              Nov 3, 2024 09:35:04.783260107 CET49772443192.168.2.643.252.37.14
                              Nov 3, 2024 09:35:04.783266068 CET4434977243.252.37.14192.168.2.6
                              Nov 3, 2024 09:35:04.783308029 CET49772443192.168.2.643.252.37.14
                              Nov 3, 2024 09:35:04.783360958 CET4977344433192.168.2.668.134.176.234
                              Nov 3, 2024 09:35:04.783458948 CET497749001192.168.2.645.89.54.11
                              Nov 3, 2024 09:35:04.783550978 CET49775443192.168.2.6162.247.74.202
                              Nov 3, 2024 09:35:04.783557892 CET44349775162.247.74.202192.168.2.6
                              Nov 3, 2024 09:35:04.783606052 CET49775443192.168.2.6162.247.74.202
                              Nov 3, 2024 09:35:04.783648968 CET49776110192.168.2.645.138.16.107
                              Nov 3, 2024 09:35:04.783750057 CET49777444192.168.2.6136.35.138.88
                              Nov 3, 2024 09:35:04.783967018 CET49778443192.168.2.65.161.247.161
                              Nov 3, 2024 09:35:04.783979893 CET443497785.161.247.161192.168.2.6
                              Nov 3, 2024 09:35:04.784030914 CET49778443192.168.2.65.161.247.161
                              Nov 3, 2024 09:35:04.784068108 CET497799201192.168.2.694.26.73.162
                              Nov 3, 2024 09:35:04.784682989 CET844349743185.220.101.206192.168.2.6
                              Nov 3, 2024 09:35:04.784732103 CET497438443192.168.2.6185.220.101.206
                              Nov 3, 2024 09:35:04.784764051 CET900149744202.61.196.212192.168.2.6
                              Nov 3, 2024 09:35:04.784806967 CET497449001192.168.2.6202.61.196.212
                              Nov 3, 2024 09:35:04.784971952 CET90014974580.92.204.251192.168.2.6
                              Nov 3, 2024 09:35:04.784990072 CET908849746152.53.111.174192.168.2.6
                              Nov 3, 2024 09:35:04.785018921 CET497459001192.168.2.680.92.204.251
                              Nov 3, 2024 09:35:04.785041094 CET497469088192.168.2.6152.53.111.174
                              Nov 3, 2024 09:35:04.785362005 CET49780443192.168.2.6162.247.74.200
                              Nov 3, 2024 09:35:04.785367966 CET44349780162.247.74.200192.168.2.6
                              Nov 3, 2024 09:35:04.785418987 CET49780443192.168.2.6162.247.74.200
                              Nov 3, 2024 09:35:04.785501957 CET497818443192.168.2.615.204.143.192
                              Nov 3, 2024 09:35:04.785605907 CET4978220901192.168.2.682.65.150.138
                              Nov 3, 2024 09:35:04.785748005 CET49783443192.168.2.6168.181.185.147
                              Nov 3, 2024 09:35:04.785756111 CET44349783168.181.185.147192.168.2.6
                              Nov 3, 2024 09:35:04.785799026 CET49783443192.168.2.6168.181.185.147
                              Nov 3, 2024 09:35:04.785845041 CET497841001192.168.2.623.88.72.105
                              Nov 3, 2024 09:35:04.785958052 CET49785443192.168.2.695.216.33.58
                              Nov 3, 2024 09:35:04.785965919 CET4434978595.216.33.58192.168.2.6
                              Nov 3, 2024 09:35:04.786005974 CET49785443192.168.2.695.216.33.58
                              Nov 3, 2024 09:35:04.786057949 CET4978610048192.168.2.6185.220.101.48
                              Nov 3, 2024 09:35:04.786148071 CET90014974988.80.26.2192.168.2.6
                              Nov 3, 2024 09:35:04.786170006 CET4978711118192.168.2.665.21.98.72
                              Nov 3, 2024 09:35:04.786179066 CET90014975037.114.57.182192.168.2.6
                              Nov 3, 2024 09:35:04.786195993 CET497499001192.168.2.688.80.26.2
                              Nov 3, 2024 09:35:04.786225080 CET497509001192.168.2.637.114.57.182
                              Nov 3, 2024 09:35:04.786287069 CET4978810050192.168.2.6185.220.101.50
                              Nov 3, 2024 09:35:04.786374092 CET93004975157.129.44.38192.168.2.6
                              Nov 3, 2024 09:35:04.786379099 CET497899001192.168.2.6194.88.105.30
                              Nov 3, 2024 09:35:04.786385059 CET326164975294.131.171.105192.168.2.6
                              Nov 3, 2024 09:35:04.786418915 CET497519300192.168.2.657.129.44.38
                              Nov 3, 2024 09:35:04.786439896 CET4975232616192.168.2.694.131.171.105
                              Nov 3, 2024 09:35:04.786459923 CET44549753137.74.5.135192.168.2.6
                              Nov 3, 2024 09:35:04.786483049 CET49790444192.168.2.651.68.155.147
                              Nov 3, 2024 09:35:04.786505938 CET49753445192.168.2.6137.74.5.135
                              Nov 3, 2024 09:35:04.786578894 CET49791443192.168.2.65.100.128.225
                              Nov 3, 2024 09:35:04.786581039 CET90024975484.247.178.134192.168.2.6
                              Nov 3, 2024 09:35:04.786585093 CET443497915.100.128.225192.168.2.6
                              Nov 3, 2024 09:35:04.786627054 CET497549002192.168.2.684.247.178.134
                              Nov 3, 2024 09:35:04.786648989 CET49791443192.168.2.65.100.128.225
                              Nov 3, 2024 09:35:04.786673069 CET497929001192.168.2.6172.114.8.83
                              Nov 3, 2024 09:35:04.786767006 CET497939001192.168.2.6161.97.132.254
                              Nov 3, 2024 09:35:04.786798000 CET610404975531.220.72.103192.168.2.6
                              Nov 3, 2024 09:35:04.786823034 CET900149756178.142.134.20192.168.2.6
                              Nov 3, 2024 09:35:04.786842108 CET4975561040192.168.2.631.220.72.103
                              Nov 3, 2024 09:35:04.786861897 CET497569001192.168.2.6178.142.134.20
                              Nov 3, 2024 09:35:04.786864996 CET497949001192.168.2.671.163.253.207
                              Nov 3, 2024 09:35:04.786890984 CET90014975782.64.150.101192.168.2.6
                              Nov 3, 2024 09:35:04.786936998 CET497579001192.168.2.682.64.150.101
                              Nov 3, 2024 09:35:04.786972046 CET900249759185.220.101.30192.168.2.6
                              Nov 3, 2024 09:35:04.786974907 CET497959091192.168.2.6162.247.74.31
                              Nov 3, 2024 09:35:04.787015915 CET497599002192.168.2.6185.220.101.30
                              Nov 3, 2024 09:35:04.787127972 CET900149748107.189.12.88192.168.2.6
                              Nov 3, 2024 09:35:04.787137985 CET90014976075.119.135.230192.168.2.6
                              Nov 3, 2024 09:35:04.787182093 CET497489001192.168.2.6107.189.12.88
                              Nov 3, 2024 09:35:04.787182093 CET497609001192.168.2.675.119.135.230
                              Nov 3, 2024 09:35:04.787208080 CET497979001192.168.2.65.39.185.164
                              Nov 3, 2024 09:35:04.787213087 CET900049761209.127.245.250192.168.2.6
                              Nov 3, 2024 09:35:04.787257910 CET497619000192.168.2.6209.127.245.250
                              Nov 3, 2024 09:35:04.787353039 CET920049762103.252.90.217192.168.2.6
                              Nov 3, 2024 09:35:04.787384033 CET90014975868.8.241.30192.168.2.6
                              Nov 3, 2024 09:35:04.787400007 CET497629200192.168.2.6103.252.90.217
                              Nov 3, 2024 09:35:04.787430048 CET497589001192.168.2.668.8.241.30
                              Nov 3, 2024 09:35:04.787451029 CET4979810035192.168.2.6185.220.101.35
                              Nov 3, 2024 09:35:04.787578106 CET497999001192.168.2.6190.211.254.192
                              Nov 3, 2024 09:35:04.787614107 CET900149765188.165.194.209192.168.2.6
                              Nov 3, 2024 09:35:04.787659883 CET497659001192.168.2.6188.165.194.209
                              Nov 3, 2024 09:35:04.787684917 CET49800443192.168.2.6178.79.154.219
                              Nov 3, 2024 09:35:04.787689924 CET44349800178.79.154.219192.168.2.6
                              Nov 3, 2024 09:35:04.787735939 CET49800443192.168.2.6178.79.154.219
                              Nov 3, 2024 09:35:04.787878990 CET900149767185.220.101.21192.168.2.6
                              Nov 3, 2024 09:35:04.787903070 CET84304976945.141.215.61192.168.2.6
                              Nov 3, 2024 09:35:04.787913084 CET90014977023.184.48.13192.168.2.6
                              Nov 3, 2024 09:35:04.787920952 CET497679001192.168.2.6185.220.101.21
                              Nov 3, 2024 09:35:04.787952900 CET90004977123.163.200.46192.168.2.6
                              Nov 3, 2024 09:35:04.787952900 CET497698430192.168.2.645.141.215.61
                              Nov 3, 2024 09:35:04.787971973 CET497709001192.168.2.623.184.48.13
                              Nov 3, 2024 09:35:04.788009882 CET497719000192.168.2.623.163.200.46
                              Nov 3, 2024 09:35:04.788216114 CET497961080192.168.2.670.39.91.101
                              Nov 3, 2024 09:35:04.788252115 CET444334977368.134.176.234192.168.2.6
                              Nov 3, 2024 09:35:04.788261890 CET90014977445.89.54.11192.168.2.6
                              Nov 3, 2024 09:35:04.788311958 CET4977344433192.168.2.668.134.176.234
                              Nov 3, 2024 09:35:04.788471937 CET1104977645.138.16.107192.168.2.6
                              Nov 3, 2024 09:35:04.788496971 CET497749001192.168.2.645.89.54.11
                              Nov 3, 2024 09:35:04.788521051 CET49776110192.168.2.645.138.16.107
                              Nov 3, 2024 09:35:04.788532972 CET44449777136.35.138.88192.168.2.6
                              Nov 3, 2024 09:35:04.788577080 CET49777444192.168.2.6136.35.138.88
                              Nov 3, 2024 09:35:04.788801908 CET498019002192.168.2.6192.42.116.195
                              Nov 3, 2024 09:35:04.788877964 CET92014977994.26.73.162192.168.2.6
                              Nov 3, 2024 09:35:04.788928032 CET497799201192.168.2.694.26.73.162
                              Nov 3, 2024 09:35:04.789005995 CET49802443192.168.2.6204.8.96.112
                              Nov 3, 2024 09:35:04.789012909 CET44349802204.8.96.112192.168.2.6
                              Nov 3, 2024 09:35:04.789057970 CET49802443192.168.2.6204.8.96.112
                              Nov 3, 2024 09:35:04.789115906 CET498039001192.168.2.645.148.17.56
                              Nov 3, 2024 09:35:04.789223909 CET49804443192.168.2.6185.129.61.3
                              Nov 3, 2024 09:35:04.789231062 CET44349804185.129.61.3192.168.2.6
                              Nov 3, 2024 09:35:04.789294004 CET49804443192.168.2.6185.129.61.3
                              Nov 3, 2024 09:35:04.789354086 CET49805465192.168.2.650.230.231.85
                              Nov 3, 2024 09:35:04.789602995 CET49806143192.168.2.645.141.215.4
                              Nov 3, 2024 09:35:04.790257931 CET84434978115.204.143.192192.168.2.6
                              Nov 3, 2024 09:35:04.790316105 CET497818443192.168.2.615.204.143.192
                              Nov 3, 2024 09:35:04.790375948 CET209014978282.65.150.138192.168.2.6
                              Nov 3, 2024 09:35:04.790375948 CET49808443192.168.2.6129.151.198.94
                              Nov 3, 2024 09:35:04.790381908 CET44349808129.151.198.94192.168.2.6
                              Nov 3, 2024 09:35:04.790422916 CET4978220901192.168.2.682.65.150.138
                              Nov 3, 2024 09:35:04.790445089 CET49808443192.168.2.6129.151.198.94
                              Nov 3, 2024 09:35:04.790486097 CET498099001192.168.2.681.201.202.101
                              Nov 3, 2024 09:35:04.790621996 CET10014978423.88.72.105192.168.2.6
                              Nov 3, 2024 09:35:04.790671110 CET497841001192.168.2.623.88.72.105
                              Nov 3, 2024 09:35:04.790788889 CET498079001192.168.2.695.148.2.122
                              Nov 3, 2024 09:35:04.790924072 CET1004849786185.220.101.48192.168.2.6
                              Nov 3, 2024 09:35:04.790935040 CET111184978765.21.98.72192.168.2.6
                              Nov 3, 2024 09:35:04.790981054 CET4978610048192.168.2.6185.220.101.48
                              Nov 3, 2024 09:35:04.791316986 CET1005049788185.220.101.50192.168.2.6
                              Nov 3, 2024 09:35:04.791327953 CET900149789194.88.105.30192.168.2.6
                              Nov 3, 2024 09:35:04.791337967 CET4444979051.68.155.147192.168.2.6
                              Nov 3, 2024 09:35:04.791352034 CET4978711118192.168.2.665.21.98.72
                              Nov 3, 2024 09:35:04.791388035 CET4978810050192.168.2.6185.220.101.50
                              Nov 3, 2024 09:35:04.791424990 CET497899001192.168.2.6194.88.105.30
                              Nov 3, 2024 09:35:04.791424990 CET49790444192.168.2.651.68.155.147
                              Nov 3, 2024 09:35:04.791465044 CET900149792172.114.8.83192.168.2.6
                              Nov 3, 2024 09:35:04.791507006 CET497929001192.168.2.6172.114.8.83
                              Nov 3, 2024 09:35:04.791649103 CET900149793161.97.132.254192.168.2.6
                              Nov 3, 2024 09:35:04.791692972 CET497939001192.168.2.6161.97.132.254
                              Nov 3, 2024 09:35:04.791702032 CET90014979471.163.253.207192.168.2.6
                              Nov 3, 2024 09:35:04.791754007 CET497949001192.168.2.671.163.253.207
                              Nov 3, 2024 09:35:04.791831017 CET909149795162.247.74.31192.168.2.6
                              Nov 3, 2024 09:35:04.791891098 CET497959091192.168.2.6162.247.74.31
                              Nov 3, 2024 09:35:04.792023897 CET9001497975.39.185.164192.168.2.6
                              Nov 3, 2024 09:35:04.792071104 CET497979001192.168.2.65.39.185.164
                              Nov 3, 2024 09:35:04.792296886 CET1003549798185.220.101.35192.168.2.6
                              Nov 3, 2024 09:35:04.792346001 CET4979810035192.168.2.6185.220.101.35
                              Nov 3, 2024 09:35:04.792392969 CET900149799190.211.254.192192.168.2.6
                              Nov 3, 2024 09:35:04.792408943 CET498109001192.168.2.6209.141.47.207
                              Nov 3, 2024 09:35:04.792435884 CET497999001192.168.2.6190.211.254.192
                              Nov 3, 2024 09:35:04.793045998 CET10804979670.39.91.101192.168.2.6
                              Nov 3, 2024 09:35:04.793104887 CET497961080192.168.2.670.39.91.101
                              Nov 3, 2024 09:35:04.793598890 CET900249801192.42.116.195192.168.2.6
                              Nov 3, 2024 09:35:04.793647051 CET498019002192.168.2.6192.42.116.195
                              Nov 3, 2024 09:35:04.793914080 CET90014980345.148.17.56192.168.2.6
                              Nov 3, 2024 09:35:04.793957949 CET498039001192.168.2.645.148.17.56
                              Nov 3, 2024 09:35:04.794159889 CET4654980550.230.231.85192.168.2.6
                              Nov 3, 2024 09:35:04.794259071 CET49805465192.168.2.650.230.231.85
                              Nov 3, 2024 09:35:04.794496059 CET1434980645.141.215.4192.168.2.6
                              Nov 3, 2024 09:35:04.794542074 CET49806143192.168.2.645.141.215.4
                              Nov 3, 2024 09:35:04.795362949 CET90014980981.201.202.101192.168.2.6
                              Nov 3, 2024 09:35:04.795418024 CET498099001192.168.2.681.201.202.101
                              Nov 3, 2024 09:35:04.795440912 CET498119001192.168.2.684.247.160.4
                              Nov 3, 2024 09:35:04.795630932 CET90014980795.148.2.122192.168.2.6
                              Nov 3, 2024 09:35:04.795686960 CET498079001192.168.2.695.148.2.122
                              Nov 3, 2024 09:35:04.797288895 CET900149810209.141.47.207192.168.2.6
                              Nov 3, 2024 09:35:04.797350883 CET498109001192.168.2.6209.141.47.207
                              Nov 3, 2024 09:35:04.798532009 CET49812443192.168.2.6178.254.45.64
                              Nov 3, 2024 09:35:04.798541069 CET44349812178.254.45.64192.168.2.6
                              Nov 3, 2024 09:35:04.798594952 CET49812443192.168.2.6178.254.45.64
                              Nov 3, 2024 09:35:04.800353050 CET90014981184.247.160.4192.168.2.6
                              Nov 3, 2024 09:35:04.800406933 CET498119001192.168.2.684.247.160.4
                              Nov 3, 2024 09:35:04.801888943 CET498138000192.168.2.6178.63.41.183
                              Nov 3, 2024 09:35:04.804964066 CET49814443192.168.2.6137.220.37.214
                              Nov 3, 2024 09:35:04.804971933 CET44349814137.220.37.214192.168.2.6
                              Nov 3, 2024 09:35:04.805026054 CET49814443192.168.2.6137.220.37.214
                              Nov 3, 2024 09:35:04.806782007 CET800049813178.63.41.183192.168.2.6
                              Nov 3, 2024 09:35:04.806835890 CET498138000192.168.2.6178.63.41.183
                              Nov 3, 2024 09:35:05.157830000 CET4971010443192.168.2.6185.40.4.95
                              Nov 3, 2024 09:35:05.157866955 CET49711443192.168.2.6185.107.57.64
                              Nov 3, 2024 09:35:05.157893896 CET49712443192.168.2.6185.220.101.201
                              Nov 3, 2024 09:35:05.157915115 CET497139001192.168.2.62.204.219.86
                              Nov 3, 2024 09:35:05.157932997 CET497149000192.168.2.6185.241.208.71
                              Nov 3, 2024 09:35:05.157952070 CET49715443192.168.2.6185.220.101.204
                              Nov 3, 2024 09:35:05.157972097 CET497169001192.168.2.6107.173.148.133
                              Nov 3, 2024 09:35:05.157990932 CET497179002192.168.2.6192.42.116.179
                              Nov 3, 2024 09:35:05.158011913 CET497189001192.168.2.695.99.30.188
                              Nov 3, 2024 09:35:05.158035994 CET4971930443192.168.2.651.195.119.159
                              Nov 3, 2024 09:35:05.158056021 CET49720443192.168.2.695.111.230.178
                              Nov 3, 2024 09:35:05.158090115 CET497218430192.168.2.645.141.215.95
                              Nov 3, 2024 09:35:05.158103943 CET49722443192.168.2.667.219.107.200
                              Nov 3, 2024 09:35:05.158123970 CET497239021192.168.2.6207.127.91.1
                              Nov 3, 2024 09:35:05.158148050 CET4972415259192.168.2.6185.227.82.15
                              Nov 3, 2024 09:35:05.158166885 CET49725443192.168.2.6109.70.100.3
                              Nov 3, 2024 09:35:05.158190966 CET497269005192.168.2.6109.70.100.71
                              Nov 3, 2024 09:35:05.158209085 CET49778443192.168.2.65.161.247.161
                              Nov 3, 2024 09:35:05.158222914 CET497509001192.168.2.637.114.57.182
                              Nov 3, 2024 09:35:05.158261061 CET497279001192.168.2.645.11.229.132
                              Nov 3, 2024 09:35:05.158277035 CET497289001192.168.2.6138.68.9.184
                              Nov 3, 2024 09:35:05.158293009 CET49729110192.168.2.6153.120.42.137
                              Nov 3, 2024 09:35:05.158308029 CET497309000192.168.2.687.98.243.204
                              Nov 3, 2024 09:35:05.158329964 CET497319001192.168.2.6194.164.16.95
                              Nov 3, 2024 09:35:05.158349037 CET49732443192.168.2.6185.183.194.90
                              Nov 3, 2024 09:35:05.158371925 CET497339000192.168.2.6192.42.116.189
                              Nov 3, 2024 09:35:05.158387899 CET497341004192.168.2.6209.127.117.90
                              Nov 3, 2024 09:35:05.158409119 CET49735443192.168.2.620.224.145.181
                              Nov 3, 2024 09:35:05.158437014 CET49736443192.168.2.657.128.180.74
                              Nov 3, 2024 09:35:05.158457994 CET497371003192.168.2.685.10.205.56
                              Nov 3, 2024 09:35:05.158473015 CET49738443192.168.2.685.90.207.39
                              Nov 3, 2024 09:35:05.158494949 CET497399100192.168.2.6185.220.100.253
                              Nov 3, 2024 09:35:05.158521891 CET49740443192.168.2.651.81.56.136
                              Nov 3, 2024 09:35:05.158540010 CET497419001192.168.2.6193.239.86.133
                              Nov 3, 2024 09:35:05.158556938 CET49742443192.168.2.623.154.177.2
                              Nov 3, 2024 09:35:05.158577919 CET497438443192.168.2.6185.220.101.206
                              Nov 3, 2024 09:35:05.158710003 CET497449001192.168.2.6202.61.196.212
                              Nov 3, 2024 09:35:05.158726931 CET497459001192.168.2.680.92.204.251
                              Nov 3, 2024 09:35:05.158751011 CET497469088192.168.2.6152.53.111.174
                              Nov 3, 2024 09:35:05.158795118 CET497519300192.168.2.657.129.44.38
                              Nov 3, 2024 09:35:05.158838987 CET49747443192.168.2.6152.67.112.12
                              Nov 3, 2024 09:35:05.158864021 CET497489001192.168.2.6107.189.12.88
                              Nov 3, 2024 09:35:05.158910990 CET497499001192.168.2.688.80.26.2
                              Nov 3, 2024 09:35:05.158940077 CET497629200192.168.2.6103.252.90.217
                              Nov 3, 2024 09:35:05.158962011 CET4975232616192.168.2.694.131.171.105
                              Nov 3, 2024 09:35:05.159358978 CET49753445192.168.2.6137.74.5.135
                              Nov 3, 2024 09:35:05.159563065 CET497549002192.168.2.684.247.178.134
                              Nov 3, 2024 09:35:05.159593105 CET4975561040192.168.2.631.220.72.103
                              Nov 3, 2024 09:35:05.159605980 CET497569001192.168.2.6178.142.134.20
                              Nov 3, 2024 09:35:05.159634113 CET497579001192.168.2.682.64.150.101
                              Nov 3, 2024 09:35:05.159657955 CET497589001192.168.2.668.8.241.30
                              Nov 3, 2024 09:35:05.159677982 CET497599002192.168.2.6185.220.101.30
                              Nov 3, 2024 09:35:05.159704924 CET497609001192.168.2.675.119.135.230
                              Nov 3, 2024 09:35:05.159719944 CET497619000192.168.2.6209.127.245.250
                              Nov 3, 2024 09:35:05.159773111 CET49763443192.168.2.683.11.190.165
                              Nov 3, 2024 09:35:05.159787893 CET49764443192.168.2.695.211.205.138
                              Nov 3, 2024 09:35:05.159813881 CET497659001192.168.2.6188.165.194.209
                              Nov 3, 2024 09:35:05.159838915 CET49766443192.168.2.6198.24.164.98
                              Nov 3, 2024 09:35:05.159861088 CET497679001192.168.2.6185.220.101.21
                              Nov 3, 2024 09:35:05.159878969 CET49768443192.168.2.646.38.233.211
                              Nov 3, 2024 09:35:05.159910917 CET497698430192.168.2.645.141.215.61
                              Nov 3, 2024 09:35:05.159919977 CET497709001192.168.2.623.184.48.13
                              Nov 3, 2024 09:35:05.159941912 CET497719000192.168.2.623.163.200.46
                              Nov 3, 2024 09:35:05.159981012 CET49772443192.168.2.643.252.37.14
                              Nov 3, 2024 09:35:05.159996986 CET4977344433192.168.2.668.134.176.234
                              Nov 3, 2024 09:35:05.160021067 CET497749001192.168.2.645.89.54.11
                              Nov 3, 2024 09:35:05.160043955 CET49775443192.168.2.6162.247.74.202
                              Nov 3, 2024 09:35:05.160063028 CET49776110192.168.2.645.138.16.107
                              Nov 3, 2024 09:35:05.160090923 CET49777444192.168.2.6136.35.138.88
                              Nov 3, 2024 09:35:05.160103083 CET497799201192.168.2.694.26.73.162
                              Nov 3, 2024 09:35:05.160130024 CET49780443192.168.2.6162.247.74.200
                              Nov 3, 2024 09:35:05.160162926 CET497818443192.168.2.615.204.143.192
                              Nov 3, 2024 09:35:05.160177946 CET4978220901192.168.2.682.65.150.138
                              Nov 3, 2024 09:35:05.160201073 CET49783443192.168.2.6168.181.185.147
                              Nov 3, 2024 09:35:05.160212994 CET497841001192.168.2.623.88.72.105
                              Nov 3, 2024 09:35:05.160239935 CET49785443192.168.2.695.216.33.58
                              Nov 3, 2024 09:35:05.160257101 CET4978610048192.168.2.6185.220.101.48
                              Nov 3, 2024 09:35:05.160274982 CET4978711118192.168.2.665.21.98.72
                              Nov 3, 2024 09:35:05.160300970 CET4978810050192.168.2.6185.220.101.50
                              Nov 3, 2024 09:35:05.160331964 CET497899001192.168.2.6194.88.105.30
                              Nov 3, 2024 09:35:05.160345078 CET49790444192.168.2.651.68.155.147
                              Nov 3, 2024 09:35:05.160362959 CET49791443192.168.2.65.100.128.225
                              Nov 3, 2024 09:35:05.160379887 CET497929001192.168.2.6172.114.8.83
                              Nov 3, 2024 09:35:05.160398006 CET497939001192.168.2.6161.97.132.254
                              Nov 3, 2024 09:35:05.160415888 CET497949001192.168.2.671.163.253.207
                              Nov 3, 2024 09:35:05.160438061 CET497959091192.168.2.6162.247.74.31
                              Nov 3, 2024 09:35:05.160459042 CET497961080192.168.2.670.39.91.101
                              Nov 3, 2024 09:35:05.160496950 CET497979001192.168.2.65.39.185.164
                              Nov 3, 2024 09:35:05.160496950 CET4979810035192.168.2.6185.220.101.35
                              Nov 3, 2024 09:35:05.160512924 CET497999001192.168.2.6190.211.254.192
                              Nov 3, 2024 09:35:05.160533905 CET49800443192.168.2.6178.79.154.219
                              Nov 3, 2024 09:35:05.160552979 CET498019002192.168.2.6192.42.116.195
                              Nov 3, 2024 09:35:05.160567999 CET49802443192.168.2.6204.8.96.112
                              Nov 3, 2024 09:35:05.160584927 CET498039001192.168.2.645.148.17.56
                              Nov 3, 2024 09:35:05.160600901 CET49804443192.168.2.6185.129.61.3
                              Nov 3, 2024 09:35:05.160624027 CET49805465192.168.2.650.230.231.85
                              Nov 3, 2024 09:35:05.160650015 CET49806143192.168.2.645.141.215.4
                              Nov 3, 2024 09:35:05.160669088 CET498079001192.168.2.695.148.2.122
                              Nov 3, 2024 09:35:05.160687923 CET49808443192.168.2.6129.151.198.94
                              Nov 3, 2024 09:35:05.160706043 CET498099001192.168.2.681.201.202.101
                              Nov 3, 2024 09:35:05.160731077 CET498109001192.168.2.6209.141.47.207
                              Nov 3, 2024 09:35:05.160773993 CET498119001192.168.2.684.247.160.4
                              Nov 3, 2024 09:35:05.160798073 CET49812443192.168.2.6178.254.45.64
                              Nov 3, 2024 09:35:05.160882950 CET498138000192.168.2.6178.63.41.183
                              Nov 3, 2024 09:35:05.160927057 CET49814443192.168.2.6137.220.37.214

                              UDP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              Nov 3, 2024 09:35:02.671516895 CET6064453192.168.2.61.1.1.1
                              Nov 3, 2024 09:35:02.710661888 CET53606441.1.1.1192.168.2.6

                              DNS Queries

                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                              Nov 3, 2024 09:35:02.671516895 CET192.168.2.61.1.1.10xcaaeStandard query (0)onionoo.torproject.orgA (IP address)IN (0x0001)false

                              DNS Answers

                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                              Nov 3, 2024 09:35:02.710661888 CET1.1.1.1192.168.2.60xcaaeNo error (0)onionoo.torproject.org204.8.99.156A (IP address)IN (0x0001)false
                              Nov 3, 2024 09:35:12.491928101 CET1.1.1.1192.168.2.60x4557No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                              Nov 3, 2024 09:35:12.491928101 CET1.1.1.1192.168.2.60x4557No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false

                              HTTP Request Dependency Graph

                              • onionoo.torproject.org

                              HTTPS Proxied Packets

                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              0192.168.2.649708204.8.99.1564436708C:\Users\user\Desktop\Payload 94.75.225.exe
                              TimestampBytes transferredDirectionData
                              2024-11-03 08:35:03 UTC165OUTGET /details?type=relay&running=true&fields=fingerprint,or_addresses HTTP/1.1
                              Host: onionoo.torproject.org
                              User-Agent: tor-relay-scanner
                              Accept-Encoding: gzip
                              2024-11-03 08:35:03 UTC448INHTTP/1.1 200 OK
                              Server: nginx
                              Date: Sun, 03 Nov 2024 08:35:03 GMT
                              Content-Type: application/json;charset=utf-8
                              Transfer-Encoding: chunked
                              Connection: close
                              Last-Modified: Sun, 03 Nov 2024 08:00:50 GMT
                              Access-Control-Allow-Origin: *
                              Cache-Control: public, max-age=2400
                              Strict-Transport-Security: max-age=15768000; preload
                              Via: HTTP/1.1 onionoo-backend-03.torproject.org
                              X-Cache-Date: Sun, 03 Nov 2024 08:04:25 GMT
                              X-Cache-Status: HIT
                              2024-11-03 08:35:03 UTC15936INData Raw: 38 30 30 30 0d 0a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 38 2e 30 22 2c 0a 22 62 75 69 6c 64 5f 72 65 76 69 73 69 6f 6e 22 3a 22 64 32 63 31 32 36 31 22 2c 0a 22 72 65 6c 61 79 73 5f 70 75 62 6c 69 73 68 65 64 22 3a 22 32 30 32 34 2d 31 31 2d 30 33 20 30 35 3a 30 30 3a 30 30 22 2c 0a 22 72 65 6c 61 79 73 22 3a 5b 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 30 30 41 31 30 44 34 33 30 31 31 45 41 34 39 32 38 41 33 35 46 36 31 30 34 30 35 46 39 32 42 34 34 33 33 42 34 44 43 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 31 30 34 2e 35 33 2e 32 32 31 2e 31 35 39 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 30 30 46 33 45 42 37 35 33 34 32 42 45 33 37 31 46 31 44 38 44 33 46 41 45 39 30 38 39 30 41 45 42 35
                              Data Ascii: 8000{"version":"8.0","build_revision":"d2c1261","relays_published":"2024-11-03 05:00:00","relays":[{"fingerprint":"000A10D43011EA4928A35F610405F92B4433B4DC","or_addresses":["104.53.221.159:9001"]},{"fingerprint":"000F3EB75342BE371F1D8D3FAE90890AEB5
                              2024-11-03 08:35:03 UTC16384INData Raw: 35 31 39 44 44 38 36 30 45 36 31 42 41 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 31 33 36 2e 32 34 33 2e 33 2e 31 39 34 3a 38 30 30 30 22 2c 22 5b 32 61 30 31 3a 34 66 38 3a 32 31 31 3a 31 64 34 31 3a 3a 32 5d 3a 38 30 30 30 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 33 44 32 45 46 46 42 41 32 31 33 32 44 44 34 33 31 30 44 41 31 32 42 37 38 35 35 34 37 32 33 33 32 33 41 43 30 34 34 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 39 31 2e 32 30 36 2e 32 32 38 2e 31 32 30 3a 39 38 39 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 33 44 41 32 30 46 44 37 31 43 45 44 31 38 38 43 38 42 37 36 35 32 45 38 31 39 34 31 43 35 30 36 37 32 34 44 42 41 36 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22
                              Data Ascii: 519DD860E61BA","or_addresses":["136.243.3.194:8000","[2a01:4f8:211:1d41::2]:8000"]},{"fingerprint":"03D2EFFBA2132DD4310DA12B78554723323AC044","or_addresses":["91.206.228.120:989"]},{"fingerprint":"03DA20FD71CED188C8B7652E81941C506724DBA6","or_addresses"
                              2024-11-03 08:35:04 UTC16384INData Raw: 34 32 36 32 36 45 42 42 46 36 43 43 30 43 37 32 43 37 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 39 31 2e 31 37 36 2e 38 39 2e 32 35 31 3a 35 34 33 32 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 37 46 30 45 36 35 32 45 34 43 43 42 30 41 30 46 31 45 38 38 44 30 30 34 36 45 43 42 33 32 32 45 36 33 31 38 43 38 36 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 37 38 2e 31 33 38 2e 39 38 2e 34 32 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 38 30 30 36 44 45 46 41 33 44 39 33 31 35 44 30 33 46 30 44 45 37 34 37 30 33 43 43 37 43 43 45 42 38 41 46 42 33 42 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 34 35 2e 31 33 38 2e 31 36 2e 34 34 3a 34 34 33 22 5d 7d 2c 0a 7b
                              Data Ascii: 42626EBBF6CC0C72C7","or_addresses":["91.176.89.251:54321"]},{"fingerprint":"07F0E652E4CCB0A0F1E88D0046ECB322E6318C86","or_addresses":["78.138.98.42:9001"]},{"fingerprint":"08006DEFA3D9315D03F0DE74703CC7CCEB8AFB3B","or_addresses":["45.138.16.44:443"]},{
                              2024-11-03 08:35:04 UTC16384INData Raw: 61 64 64 72 65 73 73 65 73 22 3a 5b 22 38 35 2e 31 39 35 2e 32 35 33 2e 31 34 32 3a 39 30 30 35 22 2c 22 5b 32 61 30 32 3a 31 36 38 3a 38 33 64 34 3a 37 37 37 37 3a 34 34 62 64 3a 63 39 66 66 3a 66 65 32 65 3a 33 31 36 35 5d 3a 34 34 33 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 43 41 36 44 39 39 33 45 39 38 39 38 45 32 30 37 33 42 42 38 36 39 34 31 43 41 34 36 45 35 32 30 31 37 32 30 31 30 41 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 38 32 2e 31 35 33 2e 31 33 38 2e 31 38 34 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 30 43 41 39 32 30 31 45 34 35 32 46 31 43 31 41 45 39 43 42 31 35 36 37 45 41 30 39 44 45 31 43 32 46 36 41 32 41 42 45 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22
                              Data Ascii: addresses":["85.195.253.142:9005","[2a02:168:83d4:7777:44bd:c9ff:fe2e:3165]:443"]},{"fingerprint":"0CA6D993E9898E2073BB86941CA46E520172010A","or_addresses":["82.153.138.184:9001"]},{"fingerprint":"0CA9201E452F1C1AE9CB1567EA09DE1C2F6A2ABE","or_addresses"
                              2024-11-03 08:35:04 UTC16384INData Raw: 46 46 43 33 35 30 38 42 44 38 45 36 41 44 46 42 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 38 34 2e 32 34 37 2e 31 38 30 2e 32 34 38 3a 39 30 30 31 22 2c 22 5b 32 61 30 32 3a 63 32 30 36 3a 33 30 31 32 3a 38 30 38 33 3a 3a 31 5d 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 31 34 46 36 46 32 41 33 41 36 45 38 41 42 39 41 43 32 42 44 35 34 42 38 43 35 41 32 30 34 43 31 43 41 35 39 34 32 42 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 33 37 2e 32 32 38 2e 31 32 39 2e 35 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 31 35 32 31 36 33 46 39 31 43 33 41 41 32 44 33 30 42 38 46 42 38 46 46 43 41 38 44 38 34 34 32 31 31 35 45 46 38 35 22 2c 22 6f 72 5f 61 64 64 72 65
                              Data Ascii: FFC3508BD8E6ADFB","or_addresses":["84.247.180.248:9001","[2a02:c206:3012:8083::1]:9001"]},{"fingerprint":"114F6F2A3A6E8AB9AC2BD54B8C5A204C1CA5942B","or_addresses":["37.228.129.5:9001"]},{"fingerprint":"1152163F91C3AA2D30B8FB8FFCA8D8442115EF85","or_addre
                              2024-11-03 08:35:04 UTC16384INData Raw: 36 32 34 34 43 43 45 33 32 30 34 45 32 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 33 38 2e 31 35 2e 31 33 31 2e 37 31 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 36 35 41 34 45 38 34 33 31 33 36 39 46 32 34 36 46 37 34 42 46 38 33 45 45 42 35 31 35 42 34 42 31 44 32 33 34 43 37 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 32 34 2e 31 39 31 2e 36 32 2e 31 30 39 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 36 36 32 36 34 31 36 38 45 38 43 43 43 42 42 32 34 34 34 41 44 45 30 46 30 41 32 32 45 34 45 36 44 44 45 46 36 46 44 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 38 37 2e 31 31 38 2e 31 31 36 2e 39 30 3a 34 34 34 22 2c 22 5b 32 30 30 31 3a 31 62
                              Data Ascii: 6244CCE3204E2","or_addresses":["38.15.131.71:9001"]},{"fingerprint":"165A4E8431369F246F74BF83EEB515B4B1D234C7","or_addresses":["24.191.62.109:9001"]},{"fingerprint":"166264168E8CCCBB2444ADE0F0A22E4E6DDEF6FD","or_addresses":["87.118.116.90:444","[2001:1b
                              2024-11-03 08:35:04 UTC16384INData Raw: 64 72 65 73 73 65 73 22 3a 5b 22 31 37 32 2e 32 33 34 2e 31 38 2e 32 32 38 3a 39 30 30 32 22 2c 22 5b 32 36 30 30 3a 33 63 30 36 3a 3a 66 30 33 63 3a 39 33 66 66 3a 66 65 66 39 3a 65 35 34 39 5d 3a 39 30 30 32 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 41 45 39 34 39 39 36 37 46 38 32 42 42 45 37 35 33 34 41 33 44 36 42 41 37 37 41 37 45 42 45 31 43 45 44 34 33 36 39 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 32 30 34 2e 38 2e 39 36 2e 38 35 3a 34 34 33 22 2c 22 5b 32 36 32 30 3a 37 3a 36 30 30 31 3a 3a 66 66 66 66 3a 63 37 35 39 3a 65 36 35 35 5d 3a 38 30 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 41 45 43 38 45 46 36 41 39 37 39 46 38 43 41 44 34 37 35 39 32 42 45 43 30 34 46 37 33 34 44 35 41
                              Data Ascii: dresses":["172.234.18.228:9002","[2600:3c06::f03c:93ff:fef9:e549]:9002"]},{"fingerprint":"1AE949967F82BBE7534A3D6BA77A7EBE1CED4369","or_addresses":["204.8.96.85:443","[2620:7:6001::ffff:c759:e655]:80"]},{"fingerprint":"1AEC8EF6A979F8CAD47592BEC04F734D5A
                              2024-11-03 08:35:04 UTC16384INData Raw: 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 36 35 2e 32 31 2e 39 34 2e 31 33 3a 39 34 34 33 22 2c 22 5b 32 61 30 31 3a 34 66 39 3a 33 62 3a 34 36 38 65 3a 3a 31 33 5d 3a 39 34 34 33 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 46 32 45 42 37 30 32 36 38 43 45 39 45 31 38 43 45 38 36 34 44 34 34 44 37 39 33 45 32 30 39 31 46 33 43 45 37 32 43 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 34 36 2e 34 2e 35 37 2e 37 35 3a 38 34 34 33 22 2c 22 5b 32 61 30 31 3a 34 66 38 3a 31 34 30 3a 31 34 36 35 3a 3a 32 5d 3a 38 34 34 33 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 46 32 46 36 33 34 44 36 44 38 37 43 46 36 43 35 33 35 38 43 31 33 36 37 46 39 42 44 35 46 39 32 36 43 45 46 33 46 34 22 2c 22 6f
                              Data Ascii: ","or_addresses":["65.21.94.13:9443","[2a01:4f9:3b:468e::13]:9443"]},{"fingerprint":"1F2EB70268CE9E18CE864D44D793E2091F3CE72C","or_addresses":["46.4.57.75:8443","[2a01:4f8:140:1465::2]:8443"]},{"fingerprint":"1F2F634D6D87CF6C5358C1367F9BD5F926CEF3F4","o
                              2024-11-03 08:35:04 UTC16384INData Raw: 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 32 31 32 2e 32 32 37 2e 32 33 34 2e 31 35 33 3a 39 30 30 31 22 2c 22 5b 32 61 30 32 3a 32 34 37 61 3a 32 33 38 3a 61 66 30 30 3a 3a 31 5d 3a 39 30 30 31 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 32 33 41 32 33 43 46 43 42 43 43 36 37 36 46 33 42 35 31 43 39 44 42 33 36 45 37 41 37 30 45 35 31 38 31 45 32 46 30 34 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 33 37 2e 36 30 2e 32 34 34 2e 32 33 3a 39 30 30 30 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 32 33 41 42 30 35 44 46 43 39 34 33 43 33 44 43 39 30 33 39 45 42 30 34 38 35 32 35 43 45 45 44 31 42 35 39 38 39 38 42 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 37 38 2e 31 35 37 2e 38 32 2e 32 30 32
                              Data Ascii: _addresses":["212.227.234.153:9001","[2a02:247a:238:af00::1]:9001"]},{"fingerprint":"23A23CFCBCC676F3B51C9DB36E7A70E5181E2F04","or_addresses":["37.60.244.23:9000"]},{"fingerprint":"23AB05DFC943C3DC9039EB048525CEED1B59898B","or_addresses":["78.157.82.202
                              2024-11-03 08:35:04 UTC16384INData Raw: 2e 31 38 2e 34 36 2e 32 33 31 3a 34 34 33 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 32 37 46 36 41 44 30 39 31 30 42 44 39 30 32 32 38 43 35 44 31 38 32 46 31 46 39 42 41 31 39 39 42 41 45 35 34 32 34 39 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 38 30 2e 39 34 2e 39 32 2e 39 32 3a 39 37 30 30 22 5d 7d 2c 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 32 37 46 41 45 39 39 43 30 44 42 41 38 43 44 39 44 42 46 45 34 32 44 32 44 32 34 36 34 42 34 43 36 38 45 45 42 30 30 44 22 2c 22 6f 72 5f 61 64 64 72 65 73 73 65 73 22 3a 5b 22 31 30 34 2e 32 34 34 2e 37 38 2e 32 33 33 3a 39 30 30 30 22 2c 22 5b 32 36 30 35 3a 36 34 30 30 3a 33 30 3a 66 35 37 64 3a 39 31 36 65 3a 37 33 66 38 3a 64 35 65 37 3a 36 37 35 62 5d 3a 39 30 30
                              Data Ascii: .18.46.231:443"]},{"fingerprint":"27F6AD0910BD90228C5D182F1F9BA199BAE54249","or_addresses":["80.94.92.92:9700"]},{"fingerprint":"27FAE99C0DBA8CD9DBFE42D2D2464B4C68EEB00D","or_addresses":["104.244.78.233:9000","[2605:6400:30:f57d:916e:73f8:d5e7:675b]:900


                              Statistics

                              CPU Usage

                              Click to jump to process

                              Memory Usage

                              Click to jump to process

                              High Level Behavior Distribution

                              Click to dive into process behavior distribution

                              Behavior

                              Click to jump to process

                              System Behavior

                              General

                              Target ID:0
                              Start time:03:35:01
                              Start date:03/11/2024
                              Path:C:\Users\user\Desktop\Payload 94.75.225.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\Users\user\Desktop\Payload 94.75.225.exe"
                              Imagebase:0x710000
                              File size:6'365'184 bytes
                              MD5 hash:C1CD02403F4CA49C8547B397DAD11A21
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:Go lang
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:1
                              Start time:03:35:02
                              Start date:03/11/2024
                              Path:C:\Windows\System32\conhost.exe
                              Wow64 process (32bit):false
                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Imagebase:0x7ff66e660000
                              File size:862'208 bytes
                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:high
                              Has exited:true

                              Disassembly

                              Reset < >

                                Executed Functions

                                Function 00778860 Relevance: .1, Instructions: 57COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2125694065.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true
                                • Associated: 00000000.00000002.2125676396.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2125896072.00000000009C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126076444.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126089984.0000000000CA4000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126101895.0000000000CA5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126114478.0000000000CA6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126126389.0000000000CA7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126140860.0000000000CA8000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126153086.0000000000CAA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126165071.0000000000CAB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126191570.0000000000CEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126203928.0000000000CF0000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126215208.0000000000CF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126229181.0000000000CFD000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126243160.0000000000D01000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126255248.0000000000D02000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D2D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126325106.0000000000D62000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126340694.0000000000D74000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126352894.0000000000D75000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_710000_Payload 94.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 4a81b3e8686fd5586489e02b61095a193f9e4492072cbdfd7f91e15e221c8bcc
                                • Instruction ID: 497d653e342e0af15040d0d1f1d4e064cc6788bc54f34d0466da3a8f233bdedb
                                • Opcode Fuzzy Hash: 4a81b3e8686fd5586489e02b61095a193f9e4492072cbdfd7f91e15e221c8bcc
                                • Instruction Fuzzy Hash: 3431972391CFC482D2218B24F5413AAB364F7A9784F15A315EFCC12A1ADF38E2E5CB40
                                Function 00774D00 Relevance: .0, Instructions: 2COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2125694065.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true
                                • Associated: 00000000.00000002.2125676396.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2125896072.00000000009C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126076444.0000000000CA2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126089984.0000000000CA4000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126101895.0000000000CA5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126114478.0000000000CA6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126126389.0000000000CA7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126140860.0000000000CA8000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126153086.0000000000CAA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126165071.0000000000CAB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126191570.0000000000CEE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126203928.0000000000CF0000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126215208.0000000000CF1000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126229181.0000000000CFD000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126243160.0000000000D01000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126255248.0000000000D02000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D2D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126267676.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126325106.0000000000D62000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126340694.0000000000D74000.00000008.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.2126352894.0000000000D75000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_710000_Payload 94.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6226d625974f41b655ebad5d25ed4558e083c2262c14460cf3d0e00d19dfb20c
                                • Instruction ID: c02407309b8921e850879da32c798c8e8d81f3346f9cd70fc296784635b22c84
                                • Opcode Fuzzy Hash: 6226d625974f41b655ebad5d25ed4558e083c2262c14460cf3d0e00d19dfb20c
                                • Instruction Fuzzy Hash: