Edit tour
Windows
Analysis Report
lavi.msi
Overview
General Information
| Sample name: | lavi.msi |
| Analysis ID: | 1555052 |
| MD5: | c65899e2519f4ad21fb4b97f0a113362 |
| SHA1: | a1f854c29a69c19949499fca5e24b02b97be46fd |
| SHA256: | 025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741 |
| Tags: | msiuser-pr0xylife |
| Infos: |   |
 | |
Detection
BruteRatel, Latrodectus
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Found malware configuration
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected BruteRatel
Yara detected Latrodectus
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Sigma detected: RunDLL32 Spawning Explorer
Writes to foreign memory regions
Checks for available system drives (often done to infect USB drives)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
msiexec.exe (PID: 7812 cmdline: "C:\Window s\System32 \msiexec.e xe" /i "C: \Users\use r\Desktop\ lavi.msi" MD5: E5DA170027542E25EDE42FC54C929077)
- msiexec.exe (PID: 7892 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077) - msiexec.exe (PID: 7960 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng 43BC20C BC49545F26 5F1331995A BDA6D MD5: 9D09DC1EDA745A5F87553048E57620CF) 
MSI2701.tmp (PID: 8028 cmdline: "C:\Window s\Installe r\MSI2701. tmp" /Dont Wait C:/Wi ndows/SysW OW64/rundl l32.exe C: \Users\use r\AppData\ Roaming\ap ptext.dll, Object MD5: B9545ED17695A32FACE8C3408A6A3553)
rundll32.exe (PID: 8088 cmdline: "C:\Window s\SysWOW64 \rundll32. exe" C:\Us ers\user\A ppData\Roa ming\appte xt.dll, Ob ject MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 8104 cmdline:
"C:\Window s\SysWOW64 \rundll32. exe" C:\Us ers\user\A ppData\Roa ming\appte xt.dll, Ob ject MD5: EF3179D498793BF4234F708D3BE28633) 
explorer.exe (PID: 4084 cmdline: C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Brute Ratel C4, BruteRatel | Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors. | No Attribution |
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Latrodectus, Latrodectus | First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware. | No Attribution |
{"C2 url": ["https://rolefenik.com/test/", "https://ergiholim.com/test/"], "Group Name": "Eta", "Campaign ID": 4037194951}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_BruteRatel_1 | Yara detected BruteRatel | Joe Security | ||
| JoeSecurity_BruteRatel_1 | Yara detected BruteRatel | Joe Security | ||
| JoeSecurity_BruteRatel_2 | Yara detected BruteRatel | Joe Security | ||
| JoeSecurity_Latrodectus | Yara detected Latrodectus | Joe Security | ||
| JoeSecurity_BruteRatel_2 | Yara detected BruteRatel | Joe Security | ||
| Click to see the 3 entries | ||||
System Summary |   |
|---|
| Source: | Author: elhoim, CD_ROM_: | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-13T10:59:33.580098+0100 | 2022930 | 1 | A Network Trojan was detected | 20.109.210.53 | 443 | 192.168.2.8 | 49706 | TCP |
| 2024-11-13T11:00:14.462381+0100 | 2022930 | 1 | A Network Trojan was detected | 172.202.163.200 | 443 | 192.168.2.8 | 58082 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-13T11:02:03.714625+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58086 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:07.268279+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58087 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:10.283737+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58088 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:13.168299+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58089 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:16.484077+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58090 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:20.188077+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58091 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:22.999986+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58092 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:25.685711+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58093 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:28.465289+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58094 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:31.244083+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58095 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:33.980071+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58096 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:36.615479+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58097 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:39.128499+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58098 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:42.362240+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58100 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:45.124335+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58101 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:47.841462+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58102 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:50.512085+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58103 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:53.401221+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58104 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:56.355343+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58105 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:59.151142+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58106 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:02.236881+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58107 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:05.299439+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58108 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:08.311583+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58109 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:11.897932+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58110 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:15.448359+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58111 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:18.492050+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58112 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:21.409415+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 58114 | 172.67.191.232 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-13T11:02:03.752840+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58086 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:09.570724+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58087 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:12.418373+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58088 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:15.758465+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58089 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:19.491450+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58090 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:22.228995+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58091 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:24.993858+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58092 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:27.739909+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58093 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:30.572059+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58094 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:33.251417+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58095 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:35.921884+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58096 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:38.445231+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58097 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:41.675497+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58098 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:44.403551+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58100 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:47.142344+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58101 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:49.821123+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58102 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:52.623944+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58103 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:55.224697+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58104 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:58.374492+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58105 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:01.524516+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58106 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:04.592517+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58107 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:07.619002+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58108 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:11.207625+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58109 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:14.603701+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58110 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:17.830438+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58111 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:20.528808+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58112 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:23.232250+0100 | 2048735 | 1 | A Network Trojan was detected | 192.168.2.8 | 58114 | 172.67.191.232 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Code function: | 4_2_004FAF79 | |
| Source: | Code function: | 11_2_02BEA8E0 | |
| Source: | Code function: | 11_2_02BF04B8 | |
| Source: | Code function: | 11_2_02BF04C0 | |
| Source: | Code function: | 11_2_02BE2B28 | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 11_2_02BE5078 | |
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 6_3_000001A99428D2C0 | |
| Source: | Code function: | 6_3_000001A99428D250 | |
| Source: | Code function: | 6_2_000001A9942A8149 | |
| Source: | Code function: | 6_2_000001A9942C45F0 | |
| Source: | Code function: | 6_2_000001A994291600 | |
| Source: | Code function: | 6_2_000001A9942A7A50 | |
| Source: | Code function: | 6_2_000001A9942C4740 | |
| Source: | Code function: | 6_2_000001A9942C3F40 | |
| Source: | Code function: | 6_2_000001A9942C4360 | |
| Source: | Code function: | 6_2_000001A9942917B0 | |
| Source: | Code function: | 6_2_000001A9942C4FF0 | |
| Source: | Code function: | 6_2_000001A9942C4BE0 | |
| Source: | Code function: | 11_2_02BE82B4 | |
| Source: | Code function: | 11_2_02BEB388 | |
| Source: | Code function: | 11_2_02BEC704 | |
| Source: | Code function: | 11_2_02BE80B8 | |
| Source: | Code function: | 11_2_02BE8240 | |
| Source: | Code function: | 11_2_02BF01A0 | |
| Source: | Code function: | 11_2_02BF01E0 | |
| Source: | Code function: | 11_2_02BF01D0 | |
| Source: | Code function: | 11_2_02BE81C8 | |
| Source: | Code function: | 11_2_02BF0130 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File deleted: | Jump to behavior | ||
| Source: | Code function: | 4_2_004C6A50 | |
| Source: | Code function: | 4_2_004FF032 | |
| Source: | Code function: | 4_2_004EE270 | |
| Source: | Code function: | 4_2_004EC2CA | |
| Source: | Code function: | 4_2_004F92A9 | |
| Source: | Code function: | 4_2_004F84BD | |
| Source: | Code function: | 4_2_004EA587 | |
| Source: | Code function: | 4_2_004CC870 | |
| Source: | Code function: | 4_2_004FD8D5 | |
| Source: | Code function: | 4_2_004EA915 | |
| Source: | Code function: | 4_2_004E4920 | |
| Source: | Code function: | 4_2_004F0A48 | |
| Source: | Code function: | 4_2_004C9CC0 | |
| Source: | Code function: | 4_2_004F5D6D | |
| Source: | Code function: | 6_2_000000018000EC30 | |
| Source: | Code function: | 6_2_00000001800F2C34 | |
| Source: | Code function: | 6_2_00000001800E1D20 | |
| Source: | Code function: | 6_2_00000001800E317C | |
| Source: | Code function: | 6_2_00000001800E358C | |
| Source: | Code function: | 6_2_00000001800E399C | |
| Source: | Code function: | 6_2_00000001800DB5E8 | |
| Source: | Code function: | 6_2_00000001800EE604 | |
| Source: | Code function: | 6_2_00000001800E5638 | |
| Source: | Code function: | 6_2_00000001800E464C | |
| Source: | Code function: | 6_2_000000018005A270 | |
| Source: | Code function: | 6_2_00000001800F32B4 | |
| Source: | Code function: | 6_2_00000001800596E0 | |
| Source: | Code function: | 6_2_00000001800036F0 | |
| Source: | Code function: | 6_2_00000001800FB318 | |
| Source: | Code function: | 6_2_000000018000B740 | |
| Source: | Code function: | 6_2_00000001800F27A0 | |
| Source: | Code function: | 6_2_00000001800F0F9C | |
| Source: | Code function: | 6_2_000001A9942C1490 | |
| Source: | Code function: | 6_2_000001A9942AA100 | |
| Source: | Code function: | 6_2_000001A994299500 | |
| Source: | Code function: | 6_2_000001A9942AB4E0 | |
| Source: | Code function: | 6_2_000001A9942A9120 | |
| Source: | Code function: | 6_2_000001A9942B4550 | |
| Source: | Code function: | 6_2_000001A994295D60 | |
| Source: | Code function: | 6_2_000001A9942A4DB0 | |
| Source: | Code function: | 6_2_000001A9942A55C0 | |
| Source: | Code function: | 6_2_000001A9942999D0 | |
| Source: | Code function: | 6_2_000001A9942BB5E0 | |
| Source: | Code function: | 6_2_000001A9942B55E0 | |
| Source: | Code function: | 6_2_000001A9942C0210 | |
| Source: | Code function: | 6_2_000001A9942B7220 | |
| Source: | Code function: | 6_2_000001A9942966C0 | |
| Source: | Code function: | 6_2_000001A9942B82A0 | |
| Source: | Code function: | 6_2_000001A9942A16A0 | |
| Source: | Code function: | 6_2_000001A9942A42A0 | |
| Source: | Code function: | 6_2_000001A9942ABED0 | |
| Source: | Code function: | 6_2_000001A9942B66E0 | |
| Source: | Code function: | 6_2_000001A99429A730 | |
| Source: | Code function: | 6_2_000001A9942C1F40 | |
| Source: | Code function: | 6_2_000001A9942C2F60 | |
| Source: | Code function: | 6_2_000001A9942B2BB0 | |
| Source: | Code function: | 6_2_000001A9942BFBC0 | |
| Source: | Code function: | 6_2_000001A9942B13A3 | |
| Source: | Code function: | 6_2_000001A9942ACBE0 | |
| Source: | Code function: | 6_2_000001A9942C2812 | |
| Source: | Code function: | 11_2_02BE1A8C | |
| Source: | Code function: | 11_2_02BE1A7C | |
| Source: | Code function: | 11_2_02BE2164 | |
| Source: | Dropped File: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary string: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 4_2_004C3860 | |
| Source: | Code function: | 4_2_004C4BA0 | |
| Source: | Code function: | 4_2_004C45B0 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 6_2_00000001800D2C10 | |
| Source: | Static PE information: | ||
| Source: | Code function: | 4_2_004E324F | |
| Source: | Code function: | 6_2_00000001800043FB | |
| Source: | Code function: | 6_2_0000000180004438 | |
| Source: | Code function: | 6_2_000000018000430B | |
| Source: | Code function: | 6_2_0000000180004327 | |
| Source: | Code function: | 11_2_02BF02BB | |
| Source: | Code function: | 11_2_02BF04C3 | |
| Source: | Code function: | 11_2_02BF02AB | |
| Source: | Code function: | 11_2_02BF02B3 | |
| Source: | Code function: | 11_2_02BF02AB | |
| Source: | Code function: | 11_2_02BF02EB | |
| Source: | Code function: | 11_2_02BF04E3 | |
| Source: | Code function: | 11_2_02BF04D3 | |
| Source: | Code function: | 11_2_02BEE6CB | |
| Source: | Code function: | 11_2_02BF04DB | |
| Source: | Code function: | 11_2_02BF04C3 | |
| Source: | Code function: | 11_2_02BF0423 | |
| Source: | Code function: | 11_2_02BF0413 | |
| Source: | Code function: | 11_2_02BF0253 | |
| Source: | Code function: | 11_2_02BF024B | |
| Source: | Code function: | 11_2_02BF0293 | |
| Source: | Code function: | 11_2_02BEF198 | |
| Source: | Code function: | 11_2_02BF039B | |
| Source: | Code function: | 11_2_02BF039B | |
| Source: | Code function: | 11_2_02BF0223 | |
| Source: | Code function: | 11_2_02BF03BB | |
| Source: | Code function: | 11_2_02BF03EB | |
| Source: | Code function: | 11_2_02BEE538 | |
| Source: | Code function: | 11_2_02BF011B | |
| Source: | Code function: | 11_2_02BF0333 | |
| Source: | Code function: | 11_2_02BF0323 | |
Persistence and Installation Behavior | |
|---|
| Source: | Executable created and started: | Jump to behavior | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Code function: | 6_2_000001A9942B4D00 | |
| Source: | Code function: | 11_2_02BE8424 | |
| Source: | Code function: | 11_2_02BE7274 | |
| Source: | Code function: | 11_2_02BF0610 | |
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Check user administrative privileges: | graph_4-33740 | ||
| Source: | Check user administrative privileges: | graph_6-26092 | ||
| Source: | API coverage: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Code function: | 4_2_004FAF79 | |
| Source: | Code function: | 11_2_02BEA8E0 | |
| Source: | Code function: | 11_2_02BF04B8 | |
| Source: | Code function: | 11_2_02BF04C0 | |
| Source: | Code function: | 11_2_02BE2B28 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 6_2_000001A99429CCE0 | |
| Source: | Code function: | 4_2_004CD0A5 | |
| Source: | Code function: | 6_2_000000018001F790 | |
| Source: | Code function: | 6_2_00000001800D2C10 | |
| Source: | Code function: | 4_2_004FAD78 | |
| Source: | Code function: | 4_2_004F2DCC | |
| Source: | Code function: | 4_2_004C2310 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 4_2_004E33A8 | |
| Source: | Code function: | 4_2_004E353F | |
| Source: | Code function: | 4_2_004E2968 | |
| Source: | Code function: | 4_2_004E6E1B | |
| Source: | Code function: | 6_2_00000001800D50A0 | |
| Source: | Code function: | 6_2_00000001800DBA64 | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Code function: | 6_3_00007DF4BD330100 | |
| Source: | Thread created: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Code function: | 4_2_004C52F0 | |
| Source: | Code function: | 6_2_0000000180001510 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 4_2_004E35A9 | |
| Source: | Code function: | 4_2_004FE0C6 | |
| Source: | Code function: | 4_2_004FE111 | |
| Source: | Code function: | 4_2_004F7132 | |
| Source: | Code function: | 4_2_004FE1AC | |
| Source: | Code function: | 4_2_004FE237 | |
| Source: | Code function: | 4_2_004E23F8 | |
| Source: | Code function: | 4_2_004FE48A | |
| Source: | Code function: | 4_2_004FE5B3 | |
| Source: | Code function: | 4_2_004F76AF | |
| Source: | Code function: | 4_2_004FE6B9 | |
| Source: | Code function: | 4_2_004FE788 | |
| Source: | Code function: | 4_2_004FDE24 | |
| Source: | Code function: | 6_2_00000001800FA4C8 | |
| Source: | Code function: | 6_2_00000001800FA160 | |
| Source: | Code function: | 6_2_00000001800FA598 | |
| Source: | Code function: | 6_2_00000001800FA9D8 | |
| Source: | Code function: | 6_2_00000001800EFEA8 | |
| Source: | Code function: | 6_2_00000001800F0328 | |
| Source: | Code function: | 6_2_00000001800FABBC | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 4_2_004E37D5 | |
| Source: | Code function: | 6_2_000001A9942B4D00 | |
| Source: | Code function: | 4_2_004F7B1F | |
| Source: | Code function: | 11_2_02BF00E8 | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 1 Replication Through Removable Media | 2 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | OS Credential Dumping | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 1 Ingress Tool Transfer | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 11 Peripheral Device Discovery | Remote Desktop Protocol | Data from Removable Media | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 82 Process Injection | 2 Obfuscated Files or Information | Security Account Manager | 1 Account Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Standard Port | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 File Deletion | LSA Secrets | 34 System Information Discovery | SSH | Keylogging | 113 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 121 Masquerading | Cached Domain Credentials | 31 Security Software Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Virtualization/Sandbox Evasion | DCSync | 1 Virtualization/Sandbox Evasion | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 82 Process Injection | Proc Filesystem | 3 Process Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 1 Rundll32 | /etc/passwd and /etc/shadow | 1 Application Window Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
| IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | Dynamic API Resolution | Network Sniffing | 1 System Owner/User Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
| Network Security Appliances | Domains | Compromise Software Dependencies and Development Tools | AppleScript | Launchd | Launchd | Stripped Payloads | Input Capture | 1 System Network Configuration Discovery | Software Deployment Tools | Remote Data Staging | Mail Protocols | Exfiltration Over Unencrypted Non-C2 Protocol | Firmware Corruption |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| rolefenik.com | 172.67.191.232 | true | false | high | |
| xomamox.com | 80.66.76.106 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| true |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| true |
| unknown | ||
| true |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 80.66.76.106 | xomamox.com | Russian Federation | 202723 | VAD-SRL-AS1MD | false | |
| 172.67.191.232 | rolefenik.com | United States | 13335 | CLOUDFLARENETUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1555052 |
| Start date and time: | 2024-11-13 10:58:17 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 9m 7s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 12 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 1 |
| Technologies: |
|
| Analysis Mode: | default |
| Sample name: | lavi.msi |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winMSI@9/24@3/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtEnumerateKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: lavi.msi
| Time | Type | Description |
|---|---|---|
| 05:01:01 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 80.66.76.106 | Get hash | malicious | BruteRatel | Browse | ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse | |||
| Get hash | malicious | BruteRatel, Latrodectus | Browse | |||
| Get hash | malicious | BruteRatel, Latrodectus | Browse | |||
| Get hash | malicious | BruteRatel, Latrodectus | Browse | |||
| 172.67.191.232 | Get hash | malicious | BruteRatel, Latrodectus | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| rolefenik.com | Get hash | malicious | BruteRatel, Latrodectus | Browse |
| |
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| xomamox.com | Get hash | malicious | BruteRatel | Browse |
| |
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | BruteRatel | Browse |
| |
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | STRRAT | Browse |
| ||
| VAD-SRL-AS1MD | Get hash | malicious | BruteRatel | Browse |
| |
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Roaming\apptext.dll | Get hash | malicious | BruteRatel | Browse | ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse | |||
| C:\Windows\Installer\MSI2527.tmp | Get hash | malicious | BruteRatel | Browse | ||
| Get hash | malicious | BruteRatel, Latrodectus | Browse | |||
| Get hash | malicious | Bazar Loader, BruteRatel | Browse | |||
| Get hash | malicious | BruteRatel | Browse | |||
| Get hash | malicious | BruteRatel | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 1193 |
| Entropy (8bit): | 5.653338257280714 |
| Encrypted: | false |
| SSDEEP: | 24:DlOgVrOpHM6aW9N7RpU4OgFPFDhiSkdGoLK:MGMTV3b1pPFD8SkdGn |
| MD5: | DE2294900053B69E159747A02CEC9126 |
| SHA1: | D84B7BD9821927B11AFFD1C5F7E1A4D48FD4EA4C |
| SHA-256: | 36C94BF3B7AA289ADFC39BACC7DE2D0CF29B9408F3B7C8A93D169FF26B5D07A2 |
| SHA-512: | C0503BC15AA261A42AABA359349649F9506822C61AFF0CE5BBAB51271ECB1A2C1042F1503E9CBFFDB67758FC0AE35E046F10A1B9061085012793D63CA0309F33 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1692160 |
| Entropy (8bit): | 6.81012301516061 |
| Encrypted: | false |
| SSDEEP: | 24576:M7u7nB/DBD9accSqVO9y/QaDC4F3Zuk5UDJjbDE2W4VO8I/nYY:My/DBD9MVO9yosHF395UlbDBw82nB |
| MD5: | 86B57C9DEAFED093D4B47B03823B4D14 |
| SHA1: | 47947DA463DD6F4ECF61AE960235A35144E903A8 |
| SHA-256: | F8E3EEF1FDA5969A7AABCC8FB5CC9F5FE245BBF6CC8E480459977B8E91EAB9BD |
| SHA-512: | 5F855ED0A3ECF561C45608D7F4579D6E4B1F1953863E97E0B5FEA1F33B38D0E03FEF16207D88864D2D936A4E65B677CD259EC248DBF06447B50F9E0488ACEAD3 |
| Malicious: | true |
| Antivirus: |
|
| Joe Sandbox View: | |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2131456 |
| Entropy (8bit): | 7.438024782173503 |
| Encrypted: | false |
| SSDEEP: | 49152:/c53YhW8zBQSc0ZnSKBZKumZr7Aej3YOXT7wYyr8lCV:QYY0Zn3K/Ai33XXZ0 |
| MD5: | C65899E2519F4AD21FB4B97F0A113362 |
| SHA1: | A1F854C29A69C19949499FCA5E24B02B97BE46FD |
| SHA-256: | 025ABBEC1724B9180B369FE116DA9D90AE47A4996F6A4E28E8A947BAC1E0C741 |
| SHA-512: | ECA93CB24187735EC54D4B4E99675F87F1957E255F59C5432498BBC2C47C77B6CCFDF48861A2F78EB377307CE8F6E6458EAF4B766B96E6C2FAEA1FB87E3DCBB4 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 446944 |
| Entropy (8bit): | 6.403916470886214 |
| Encrypted: | false |
| SSDEEP: | 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr |
| MD5: | 475D20C0EA477A35660E3F67ECF0A1DF |
| SHA1: | 67340739F51E1134AE8F0FFC5AE9DD710E8E3A08 |
| SHA-256: | 426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD |
| SHA-512: | 99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 446944 |
| Entropy (8bit): | 6.403916470886214 |
| Encrypted: | false |
| SSDEEP: | 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr |
| MD5: | 475D20C0EA477A35660E3F67ECF0A1DF |
| SHA1: | 67340739F51E1134AE8F0FFC5AE9DD710E8E3A08 |
| SHA-256: | 426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD |
| SHA-512: | 99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 446944 |
| Entropy (8bit): | 6.403916470886214 |
| Encrypted: | false |
| SSDEEP: | 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr |
| MD5: | 475D20C0EA477A35660E3F67ECF0A1DF |
| SHA1: | 67340739F51E1134AE8F0FFC5AE9DD710E8E3A08 |
| SHA-256: | 426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD |
| SHA-512: | 99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 446944 |
| Entropy (8bit): | 6.403916470886214 |
| Encrypted: | false |
| SSDEEP: | 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr |
| MD5: | 475D20C0EA477A35660E3F67ECF0A1DF |
| SHA1: | 67340739F51E1134AE8F0FFC5AE9DD710E8E3A08 |
| SHA-256: | 426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD |
| SHA-512: | 99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 400992 |
| Entropy (8bit): | 6.59159515749273 |
| Encrypted: | false |
| SSDEEP: | 6144:6MvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1P:6MvZx0FlS68zBQSncb4ZPQTpAjZxqO1P |
| MD5: | 9A4B8A32A74A2B76C73AA21A4911D47A |
| SHA1: | 8FCD2EA10021B0AE2E837335001F87AC63F161CC |
| SHA-256: | 2069DD0CC6A0CB9240597DB508E5E856200D861729A63259B65E18C931ECA950 |
| SHA-512: | F99B18E7A88CF500BA2511D96693EB29F4CAF7A941BEFB9C3B3CCC05BBFE302E74A5685697AF86574BEE7CD3043D23A88589F1EE891ADC0B4CE54E9DB674090B |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 399328 |
| Entropy (8bit): | 6.589290025452677 |
| Encrypted: | false |
| SSDEEP: | 6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1 |
| MD5: | B9545ED17695A32FACE8C3408A6A3553 |
| SHA1: | F6C31C9CD832AE2AEBCD88E7B2FA6803AE93FC83 |
| SHA-256: | 1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A |
| SHA-512: | F6D6DC40DCBA5FF091452D7CC257427DCB7CE2A21816B4FEC2EE249E63246B64667F5C4095220623533243103876433EF8C12C9B612C0E95FDFFFE41D1504E04 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20480 |
| Entropy (8bit): | 1.1610705500378629 |
| Encrypted: | false |
| SSDEEP: | 12:JSbX72FjdAGiLIlHVRpzh/7777777777777777777777777vDHFmTu5Rp01l0i8Q:JnQI53Yu5s8F |
| MD5: | 434F1256BD3A1512E8F777D06D423E06 |
| SHA1: | 480B214D329682582A7A7732B4683B71653ADB6B |
| SHA-256: | 04393CD51A1910F172DE0DF47EB55E2B3C82D9259EF312559EB7CE3864481BB2 |
| SHA-512: | BB1A7A934FDB62CFBF1BE0CD668E968F8E89E6C2563EC55142A28040A336FC29FE2B5AE2B7FFFF3C277529F67062C8528372645000D127F208B0125C2480EB1A |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20480 |
| Entropy (8bit): | 1.5343237055833994 |
| Encrypted: | false |
| SSDEEP: | 48:G8PhFuRc06WXOCFT5vIUPsHSgJAEkCyGG2HSgtTK8K:ZhF1UFT2UkH5KvCVfH54 |
| MD5: | 379ABC7BAEE1E9B17C178DFE27D302EC |
| SHA1: | A38D32CA99C4E82F3A194FFF6FBEB9693F8D454B |
| SHA-256: | AC918A4D4842416AEB47FA24324F392DAB042B57D72FDBE74863C2456A913218 |
| SHA-512: | 912C2BA531C9173E321957B894A4FAC5423B69C82F0798AF19923948BBF99E1797CB208E33DEE8B7FF7F6F5716BC995762FEF74A7791ED3B3BD625BAA47197FC |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 360001 |
| Entropy (8bit): | 5.36298284158752 |
| Encrypted: | false |
| SSDEEP: | 1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau0:zTtbmkExhMJCIpEZ |
| MD5: | CFFF49353FCC764E37C57C3BECC3C7D3 |
| SHA1: | 06CF69EF44C5584B686304B5BABFD6C4D9F62DA2 |
| SHA-256: | 83BA488E797397764AE030A5ABCA47EB7EB0279E3590F7122551D5603C5B72E8 |
| SHA-512: | A8A242EFA1F401AFD3E4758571E73470D97E1B4B311C113ADB4D6E0A104214397E133C1A75045094FDDF225B4D5AB8DCA34D3B3251B9CA6E9D267E692457AB31 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 1.2321256188792842 |
| Encrypted: | false |
| SSDEEP: | 48:XC9u2PvcFXOTT5LhIUPsHSgJAEkCyGG2HSgtTK8K:y94OTUUkH5KvCVfH54 |
| MD5: | D7C01E8F3B42D4F934B20538280A4DF6 |
| SHA1: | D5082C83336245DA4A54F6AD60A8A7EE2D31494A |
| SHA-256: | 478EA91C1CB1D5C3B0E0C1733CC069A3B1F72BBD2E021CC2B185BDB0B031022B |
| SHA-512: | 9F63860407818B65B86E947F843BBF38AFD2BEB2705845D36DF124914985CD3CF6035EAF1E1DB24C647D2FCC980159E233445A85A82BF0CDCC70C32ED8AE705E |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20480 |
| Entropy (8bit): | 1.5343237055833994 |
| Encrypted: | false |
| SSDEEP: | 48:G8PhFuRc06WXOCFT5vIUPsHSgJAEkCyGG2HSgtTK8K:ZhF1UFT2UkH5KvCVfH54 |
| MD5: | 379ABC7BAEE1E9B17C178DFE27D302EC |
| SHA1: | A38D32CA99C4E82F3A194FFF6FBEB9693F8D454B |
| SHA-256: | AC918A4D4842416AEB47FA24324F392DAB042B57D72FDBE74863C2456A913218 |
| SHA-512: | 912C2BA531C9173E321957B894A4FAC5423B69C82F0798AF19923948BBF99E1797CB208E33DEE8B7FF7F6F5716BC995762FEF74A7791ED3B3BD625BAA47197FC |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20480 |
| Entropy (8bit): | 1.5343237055833994 |
| Encrypted: | false |
| SSDEEP: | 48:G8PhFuRc06WXOCFT5vIUPsHSgJAEkCyGG2HSgtTK8K:ZhF1UFT2UkH5KvCVfH54 |
| MD5: | 379ABC7BAEE1E9B17C178DFE27D302EC |
| SHA1: | A38D32CA99C4E82F3A194FFF6FBEB9693F8D454B |
| SHA-256: | AC918A4D4842416AEB47FA24324F392DAB042B57D72FDBE74863C2456A913218 |
| SHA-512: | 912C2BA531C9173E321957B894A4FAC5423B69C82F0798AF19923948BBF99E1797CB208E33DEE8B7FF7F6F5716BC995762FEF74A7791ED3B3BD625BAA47197FC |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 1.2321256188792842 |
| Encrypted: | false |
| SSDEEP: | 48:XC9u2PvcFXOTT5LhIUPsHSgJAEkCyGG2HSgtTK8K:y94OTUUkH5KvCVfH54 |
| MD5: | D7C01E8F3B42D4F934B20538280A4DF6 |
| SHA1: | D5082C83336245DA4A54F6AD60A8A7EE2D31494A |
| SHA-256: | 478EA91C1CB1D5C3B0E0C1733CC069A3B1F72BBD2E021CC2B185BDB0B031022B |
| SHA-512: | 9F63860407818B65B86E947F843BBF38AFD2BEB2705845D36DF124914985CD3CF6035EAF1E1DB24C647D2FCC980159E233445A85A82BF0CDCC70C32ED8AE705E |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 0.0680023241589871 |
| Encrypted: | false |
| SSDEEP: | 6:2/9LG7iVCnLG7iVrKOzPLHKOmTuKIdEoVky6l0t/:2F0i8n0itFzDHFmTu5o01 |
| MD5: | 4FB58FE1D5CC331A5D874D0F396E8B0F |
| SHA1: | FD23F6E7DA165E585D60185ABB95179BD349EFA4 |
| SHA-256: | 8D8B81F85995EE111CE0BA925E4E1653B355DBD900B61BB513D761FF393BD9C8 |
| SHA-512: | 252ED694BC4861DFC13C16B0F40EDCA0EE7F4FB1644C05106980AC24B11D39E344AA8E47CB96609F8E3E2AD9A8A347530CEAA41EA367C902CA3A1F62173CCBD6 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 1.2321256188792842 |
| Encrypted: | false |
| SSDEEP: | 48:XC9u2PvcFXOTT5LhIUPsHSgJAEkCyGG2HSgtTK8K:y94OTUUkH5KvCVfH54 |
| MD5: | D7C01E8F3B42D4F934B20538280A4DF6 |
| SHA1: | D5082C83336245DA4A54F6AD60A8A7EE2D31494A |
| SHA-256: | 478EA91C1CB1D5C3B0E0C1733CC069A3B1F72BBD2E021CC2B185BDB0B031022B |
| SHA-512: | 9F63860407818B65B86E947F843BBF38AFD2BEB2705845D36DF124914985CD3CF6035EAF1E1DB24C647D2FCC980159E233445A85A82BF0CDCC70C32ED8AE705E |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 73728 |
| Entropy (8bit): | 0.1263065537968079 |
| Encrypted: | false |
| SSDEEP: | 24:VKppoTxbApHipVbAppbApHipVbApJAEVbyjCyEpGVPwG+do+hTz:VK3oTEHSgMHSgJAEkCyGGqoUv |
| MD5: | 9F97714CD663BA87530D8B53D9B4FB10 |
| SHA1: | DA891E0F657B7824F8FE7C341BAE291E1AA2E9DD |
| SHA-256: | 0E60058AEA8B4DC6D0BE4ED63B9ACA7EF6B58DF0045A5C07CB8984170F82A277 |
| SHA-512: | ECEF2DD3A535D1EDFE2E06A7EA4637F90CC91D944B1D75F806BD38C63D2801BD77A64BF3A418AE2BED3F535A50581F359E9DEC76EEE024A02347FCC6618766D6 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.438024782173503 |
| TrID: |
|
| File name: | lavi.msi |
| File size: | 2'131'456 bytes |
| MD5: | c65899e2519f4ad21fb4b97f0a113362 |
| SHA1: | a1f854c29a69c19949499fca5e24b02b97be46fd |
| SHA256: | 025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741 |
| SHA512: | eca93cb24187735ec54d4b4e99675f87f1957e255f59c5432498bbc2c47c77b6ccfdf48861a2f78eb377307ce8f6e6458eaf4b766b96e6c2faea1fb87e3dcbb4 |
| SSDEEP: | 49152:/c53YhW8zBQSc0ZnSKBZKumZr7Aej3YOXT7wYyr8lCV:QYY0Zn3K/Ai33XXZ0 |
| TLSH: | 44A5F12233C6C537C9AE01307A1AD66B557DFCA74B3140D7A3C82A2EAE745C06639F97 |
| File Content Preview: | ........................>...................!...................................E.......a...............................(...)...*...+...,...-...........A...B...C...D...E...F...G...H...I...J...K...L...M...N.................................................. |
 | |
| Icon Hash: | 2d2e3797b32b2b99 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-13T10:59:33.580098+0100 | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 1 | 20.109.210.53 | 443 | 192.168.2.8 | 49706 | TCP |
| 2024-11-13T11:00:14.462381+0100 | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 1 | 172.202.163.200 | 443 | 192.168.2.8 | 58082 | TCP |
| 2024-11-13T11:02:03.714625+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58086 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:03.752840+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58086 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:07.268279+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58087 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:09.570724+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58087 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:10.283737+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58088 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:12.418373+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58088 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:13.168299+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58089 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:15.758465+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58089 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:16.484077+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58090 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:19.491450+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58090 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:20.188077+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58091 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:22.228995+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58091 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:22.999986+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58092 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:24.993858+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58092 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:25.685711+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58093 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:27.739909+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58093 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:28.465289+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58094 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:30.572059+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58094 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:31.244083+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58095 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:33.251417+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58095 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:33.980071+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58096 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:35.921884+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58096 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:36.615479+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58097 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:38.445231+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58097 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:39.128499+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58098 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:41.675497+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58098 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:42.362240+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58100 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:44.403551+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58100 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:45.124335+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58101 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:47.142344+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58101 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:47.841462+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58102 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:49.821123+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58102 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:50.512085+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58103 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:52.623944+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58103 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:53.401221+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58104 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:55.224697+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58104 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:56.355343+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58105 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:58.374492+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58105 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:02:59.151142+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58106 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:01.524516+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58106 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:02.236881+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58107 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:04.592517+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58107 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:05.299439+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58108 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:07.619002+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58108 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:08.311583+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58109 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:11.207625+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58109 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:11.897932+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58110 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:14.603701+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58110 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:15.448359+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58111 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:17.830438+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58111 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:18.492050+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58112 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:20.528808+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58112 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:21.409415+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 58114 | 172.67.191.232 | 443 | TCP |
| 2024-11-13T11:03:23.232250+0100 | 2048735 | ET MALWARE Latrodectus Loader Related Activity (POST) | 1 | 192.168.2.8 | 58114 | 172.67.191.232 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 13, 2024 10:59:23.493935108 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:23.498780012 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:23.498838902 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:23.534854889 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:23.539695978 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:29.721121073 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:29.721151114 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:29.721169949 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:29.721180916 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:29.721281052 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:29.721281052 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:29.770627022 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:29.785088062 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:36.437524080 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:36.437602043 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:36.446918964 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:36.453592062 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:58.140455008 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:58.140543938 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:58.141598940 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:58.146780014 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 10:59:58.146878004 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:58.147202969 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 10:59:58.152236938 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:01.036990881 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:01.037087917 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:01.037544966 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:01.038780928 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:01.042448997 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:01.043991089 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054543972 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054574966 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054593086 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054608107 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054625988 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054634094 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.054686069 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.054686069 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.054693937 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054712057 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054730892 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054744959 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.054757118 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.054775000 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.054790020 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.054831982 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.055382967 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.055429935 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.055460930 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.055505037 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.060288906 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.060342073 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.060522079 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.060575962 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.173367977 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.173470020 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.173562050 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.173577070 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.173603058 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.173616886 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.173616886 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.173619032 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.173652887 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.173652887 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.173727989 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.173754930 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.173789978 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.173789978 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.174292088 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.174355984 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.174401045 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.174444914 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.174489975 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.174505949 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.174523115 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.174535990 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.174571991 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.174571991 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.174611092 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.174662113 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292177916 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292213917 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292226076 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292257071 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292278051 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292278051 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292304993 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292315960 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292318106 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292336941 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292356014 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292676926 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292710066 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292720079 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.292726994 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292753935 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.292753935 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293040991 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293090105 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293139935 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293188095 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293241024 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293282032 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293292999 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293306112 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293350935 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293350935 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293386936 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293435097 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293939114 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293950081 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.293996096 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.293997049 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.410957098 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.410981894 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.410991907 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411026955 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411045074 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.411045074 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.411139011 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.411171913 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411223888 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.411235094 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411246061 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411256075 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411283970 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.411325932 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.411767960 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411818981 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.411984921 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.411993980 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.412030935 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.412034035 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.412043095 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.412065029 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.412065029 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.412091017 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.412365913 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.412379026 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.412389040 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.412425041 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.412425041 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.457911968 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.458036900 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.458040953 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.458141088 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.529881001 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530003071 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530010939 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530024052 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530077934 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530081034 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530081987 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530091047 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530102968 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530128956 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530165911 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530424118 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530478001 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530518055 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530565977 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530883074 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530930042 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.530976057 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.530986071 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531029940 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531029940 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531075954 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531105042 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531116962 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531127930 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531153917 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531155109 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531447887 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531497955 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531518936 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531562090 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531636000 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531653881 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.531687975 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.531687975 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.620917082 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.621016026 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.621143103 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.621283054 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.649113894 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649180889 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.649389029 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649400949 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649411917 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649422884 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649435043 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649447918 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.649482965 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.649770021 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649780989 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649791956 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:33.649826050 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:33.649858952 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.277231932 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277280092 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277292013 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277323008 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277340889 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277350903 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277364016 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277400970 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.277477980 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277478933 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.277489901 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277502060 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.277532101 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.277559996 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.278182030 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.278239965 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.278409958 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.278409958 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396480083 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396538019 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396598101 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396631002 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396666050 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396699905 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396733999 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396733999 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396733999 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396733999 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396733999 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396733999 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396766901 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396800995 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396828890 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396828890 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396830082 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396836042 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396863937 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396874905 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.396923065 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.396941900 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.397067070 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.397123098 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.397131920 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.397157907 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.397171974 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.397207975 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.398142099 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.398180008 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.398209095 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.398247957 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515333891 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515501976 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515522003 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515544891 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515582085 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515602112 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515616894 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515635014 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515650034 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515650034 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515650034 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515650034 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515674114 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515692949 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515696049 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515722036 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.515722990 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515749931 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.515768051 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.516164064 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.516199112 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.516228914 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.516232014 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.516249895 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.516252041 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.516279936 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.516289949 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.516379118 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634488106 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634541988 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634593964 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634593964 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634603024 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634639025 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634659052 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634675026 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634689093 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634730101 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634733915 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634768009 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634804964 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634810925 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634810925 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634843111 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634844065 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634874105 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634876966 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634910107 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634924889 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634943962 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634982109 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.634984016 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.634984016 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.635029078 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.635536909 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.635592937 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.635593891 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.635627985 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.635643959 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.635663986 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.635669947 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.635700941 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.753716946 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.753773928 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.753815889 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.753849983 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.753885984 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.753909111 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.753920078 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.753946066 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.753946066 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.753957033 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.753966093 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.753992081 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754000902 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754026890 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754034042 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754060984 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754069090 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754097939 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754102945 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754143953 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754219055 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754271984 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754275084 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754311085 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754323006 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754344940 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754368067 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754378080 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754379988 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754421949 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754795074 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754847050 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754851103 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754884958 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.754915953 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.754915953 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.872483015 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872555017 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872592926 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872627020 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872680902 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872714996 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872749090 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872781992 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872778893 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.872778893 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.872821093 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.872872114 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.872872114 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.872872114 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.873871088 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.873904943 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.873941898 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.873941898 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.873959064 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.873992920 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.874006033 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.874027014 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.874030113 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.874059916 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.874078035 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.874094009 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.874099970 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.874149084 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.874183893 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.874217033 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.874221087 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.874221087 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.874221087 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.874258041 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.992835045 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.992893934 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.992932081 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.992934942 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.992934942 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:00:41.992997885 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:00:41.993182898 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:12.273261070 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:12.587358952 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:12.592381954 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:12.592433929 CET | 49705 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:12.592437029 CET | 8877 | 49705 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:25.118254900 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:25.123188972 CET | 8877 | 58085 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:25.123296022 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:25.123575926 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:25.128340960 CET | 8877 | 58085 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:32.972527981 CET | 8877 | 58085 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:32.972654104 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:32.973151922 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:32.977952003 CET | 8877 | 58085 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:32.978008032 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:01:32.982848883 CET | 8877 | 58085 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:51.033907890 CET | 8877 | 58085 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:01:51.034327030 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:03.096438885 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:03.096501112 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:03.096558094 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:03.096884012 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:03.096894979 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:03.714534998 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:03.714624882 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:03.747946978 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:03.747997046 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:03.748402119 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:03.751991987 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:03.752566099 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:03.795340061 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:05.734975100 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:05.735120058 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:05.735279083 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:05.747689962 CET | 58086 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:05.747708082 CET | 443 | 58086 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:06.650965929 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:06.651071072 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:06.651571035 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:06.651870966 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:06.651891947 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:07.268204927 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:07.268279076 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:07.268759012 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:07.268771887 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:07.270546913 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:07.270551920 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:09.570720911 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:09.570785999 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:09.570822954 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:09.570884943 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:09.576571941 CET | 58087 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:09.576600075 CET | 443 | 58087 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:09.662058115 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:09.662101984 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:09.662210941 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:09.663336039 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:09.663351059 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:10.281301975 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:10.283736944 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:10.291920900 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:10.291930914 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:10.295336962 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:10.295344114 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:12.418210983 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:12.418278933 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:12.420222044 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:12.440248966 CET | 58088 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:12.440263987 CET | 443 | 58088 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:12.547938108 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:12.547980070 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:12.548075914 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:12.549000978 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:12.549016953 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:13.168234110 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:13.168298960 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:13.168693066 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:13.168698072 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:13.169651985 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:13.169656992 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:15.758476019 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:15.758550882 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:15.758552074 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:15.758939028 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:15.776212931 CET | 58089 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:15.776240110 CET | 443 | 58089 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:15.862509012 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:15.862551928 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:15.862720966 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:15.863120079 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:15.863137960 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:16.481421947 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:16.484076977 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:16.485452890 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:16.485452890 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:16.485460043 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:16.485474110 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.443041086 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.443067074 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.443078041 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.443140984 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:19.443140984 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:19.443141937 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:19.491358042 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.491410017 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.491472006 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:19.491504908 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:19.495697021 CET | 58090 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:19.495712042 CET | 443 | 58090 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.573832989 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:19.573863983 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:19.574023962 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:19.574364901 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:19.574372053 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:20.184325933 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:20.188076973 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:20.189424038 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:20.189424038 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:20.189433098 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:20.189481974 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:22.228959084 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:22.229016066 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:22.229074955 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:22.239542007 CET | 58091 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:22.239562988 CET | 443 | 58091 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:22.358328104 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:22.358369112 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:22.359467030 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:22.359946966 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:22.359961987 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:22.999387980 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:22.999985933 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:23.043447018 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:23.043458939 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:23.044975996 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:23.044980049 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:24.993869066 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:24.993933916 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:24.993938923 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:24.993972063 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.009768963 CET | 58092 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.009795904 CET | 443 | 58092 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:25.087730885 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.087835073 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:25.087913990 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.088192940 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.088232994 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:25.685642958 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:25.685710907 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.693715096 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.693736076 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:25.743864059 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:25.743885994 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:27.739975929 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:27.740144968 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:27.744285107 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:27.744286060 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:27.851484060 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:27.851536036 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:27.851954937 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:27.852159977 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:27.852176905 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:28.211716890 CET | 58093 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:28.211793900 CET | 443 | 58093 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:28.461236954 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:28.465289116 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:28.465289116 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:28.465289116 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:28.465318918 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:28.465339899 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:30.572088003 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:30.572155952 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:30.572177887 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:30.576037884 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:30.576037884 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:30.628361940 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:30.628444910 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:30.632036924 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:30.635966063 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:30.635999918 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:30.882374048 CET | 58094 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:30.882404089 CET | 443 | 58094 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:31.244015932 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:31.244082928 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:31.244673014 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:31.244684935 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:31.246473074 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:31.246479034 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.251488924 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.251619101 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.251640081 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.251692057 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.251983881 CET | 58095 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.252017021 CET | 443 | 58095 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.369206905 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.369232893 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.369285107 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.369561911 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.369570017 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.977998972 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.980071068 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.981311083 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.981311083 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:33.981331110 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:33.981365919 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:35.921798944 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:35.921885014 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:35.921982050 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:35.922209978 CET | 58096 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:35.922229052 CET | 443 | 58096 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:35.994199038 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:35.994237900 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:35.994400978 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:35.994661093 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:35.994676113 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:36.615406036 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:36.615478992 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:36.616800070 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:36.616806984 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:36.617305994 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:36.617310047 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:38.445245981 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:38.445300102 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:38.445451975 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:38.448071003 CET | 58097 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:38.448087931 CET | 443 | 58097 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:38.507518053 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:38.507585049 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:38.507852077 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:38.512082100 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:38.512100935 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:39.128438950 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:39.128499031 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:39.129117012 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:39.129136086 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:39.130549908 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:39.130554914 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.086849928 CET | 58081 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:41.092109919 CET | 8877 | 58081 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.104847908 CET | 58099 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:41.109879971 CET | 8877 | 58099 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.109952927 CET | 58099 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:41.110488892 CET | 58099 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:41.115259886 CET | 8877 | 58099 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.675421953 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.675502062 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.675503016 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:41.675549030 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:41.675755978 CET | 58098 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:41.675781965 CET | 443 | 58098 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.753165007 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:41.753283978 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.756114960 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:41.756369114 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:41.756406069 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.939198017 CET | 8877 | 58099 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.942351103 CET | 58099 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:41.943881989 CET | 58099 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:41.943881989 CET | 58099 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:41.948848009 CET | 8877 | 58099 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:41.948873043 CET | 8877 | 58099 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:42.362071991 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:42.362240076 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:42.365072966 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:42.365073919 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:42.365091085 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:42.365108013 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:44.403559923 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:44.403633118 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:44.404269934 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:44.404269934 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:44.488168955 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:44.488220930 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:44.490864038 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:44.490864038 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:44.490911961 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:44.756805897 CET | 58100 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:44.756844997 CET | 443 | 58100 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:45.124250889 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:45.124335051 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:45.176753044 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:45.176810026 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:45.199784994 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:45.199841976 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.142401934 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.142462969 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.142494917 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.142514944 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.142534971 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.142558098 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.142779112 CET | 58101 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.142792940 CET | 443 | 58101 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.220108032 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.220163107 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.220222950 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.220582962 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.220599890 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.836010933 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.841461897 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.841461897 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.841461897 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:47.841496944 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:47.841532946 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:49.820970058 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:49.821024895 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:49.821397066 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:49.822086096 CET | 58102 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:49.822133064 CET | 443 | 58102 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:49.896879911 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:49.896967888 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:49.898801088 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:49.899369001 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:49.899382114 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:50.269625902 CET | 8877 | 58099 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:02:50.274003029 CET | 58099 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:02:50.510699987 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:50.512084961 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:50.512665987 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:50.512684107 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:50.513555050 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:50.513567924 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:52.623966932 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:52.624031067 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:52.624118090 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:52.627995014 CET | 58103 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:52.628017902 CET | 443 | 58103 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:52.764416933 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:52.764527082 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:52.764795065 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:52.767998934 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:52.768043041 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:53.401137114 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:53.401221037 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:53.401969910 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:53.401983976 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:53.403017044 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:53.403023958 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:55.224709988 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:55.224766016 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:55.224777937 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:55.224812031 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:55.225178957 CET | 58104 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:55.225202084 CET | 443 | 58104 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:55.749654055 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:55.749700069 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:55.749774933 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:55.750010967 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:55.750024080 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:56.354991913 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:56.355343103 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:56.357201099 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:56.357201099 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:56.357234001 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:56.357275009 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:58.374526978 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:58.374629021 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:58.374667883 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:58.378308058 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:58.382680893 CET | 58105 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:58.382702112 CET | 443 | 58105 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:58.522171974 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:58.522275925 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:58.526490927 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:58.526490927 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:58.526578903 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:59.151068926 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:59.151141882 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:59.151607037 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:59.151627064 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:02:59.153003931 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:02:59.153014898 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:01.524415016 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:01.524477959 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:01.524502993 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:01.524585962 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:01.524657965 CET | 58106 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:01.524704933 CET | 443 | 58106 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:01.611067057 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:01.611181974 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:01.611265898 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:01.611504078 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:01.611530066 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:02.234533072 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:02.236881018 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:02.236881018 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:02.236927032 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:02.243505001 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:02.243511915 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:02.290465117 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:02.297291994 CET | 8877 | 58085 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:03:02.299993992 CET | 58085 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:04.592155933 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:04.592250109 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:04.592358112 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:04.592505932 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:04.592556953 CET | 58107 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:04.592600107 CET | 443 | 58107 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:04.675477982 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:04.675529003 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:04.675726891 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:04.676140070 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:04.676152945 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:05.299349070 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:05.299438953 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:05.300091982 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:05.300111055 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:05.301808119 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:05.301829100 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:07.619025946 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:07.619185925 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:07.619230032 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:07.619302034 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:07.619369984 CET | 58108 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:07.619411945 CET | 443 | 58108 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:07.701107979 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:07.701220989 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:07.701471090 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:07.701587915 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:07.701617956 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:08.307857037 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:08.311583042 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:08.312755108 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:08.312755108 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:08.312786102 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:08.312833071 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.207629919 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.207703114 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.207706928 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.207751989 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.207895994 CET | 58109 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.207926989 CET | 443 | 58109 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.287736893 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.287817001 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.287887096 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.288177967 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.288203955 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.897500038 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.897932053 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.898272038 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.898299932 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:11.904033899 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:11.904076099 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:14.603709936 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:14.603776932 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:14.604296923 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:14.607085943 CET | 58110 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:14.607130051 CET | 443 | 58110 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:14.688028097 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:14.688096046 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:14.688383102 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:14.688417912 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:14.688426018 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:15.448308945 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:15.448359013 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:15.448913097 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:15.448924065 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:15.450834036 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:15.450839043 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:17.830323935 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:17.830488920 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:17.830543041 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:17.830626011 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:17.830626011 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:17.884116888 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:17.884145975 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:17.888258934 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:17.888258934 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:17.888286114 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:18.135369062 CET | 58111 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:18.135401964 CET | 443 | 58111 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:18.487180948 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:18.492049932 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:18.492049932 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:18.492069960 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:18.495538950 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:18.495551109 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:20.439498901 CET | 58113 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:20.444794893 CET | 8877 | 58113 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:03:20.444941044 CET | 58113 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:20.445261955 CET | 58113 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:20.451217890 CET | 8877 | 58113 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:03:20.528692961 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:20.528827906 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:20.539064884 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:20.544673920 CET | 58112 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:20.544707060 CET | 443 | 58112 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:20.780016899 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:20.780066967 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:20.784105062 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:20.788014889 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:20.788027048 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:21.274148941 CET | 8877 | 58113 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:03:21.274211884 CET | 58113 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:21.274636030 CET | 58113 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:21.276021004 CET | 58113 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Nov 13, 2024 11:03:21.279638052 CET | 8877 | 58113 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:03:21.281243086 CET | 8877 | 58113 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:03:21.409349918 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:21.409415007 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:21.409888029 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:21.409895897 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:21.411159039 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:21.411164045 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:23.232287884 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:23.232340097 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:23.232351065 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:23.232386112 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:23.232439041 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:23.232532978 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:25.399539948 CET | 58114 | 443 | 192.168.2.8 | 172.67.191.232 |
| Nov 13, 2024 11:03:25.399561882 CET | 443 | 58114 | 172.67.191.232 | 192.168.2.8 |
| Nov 13, 2024 11:03:26.346013069 CET | 8877 | 58113 | 80.66.76.106 | 192.168.2.8 |
| Nov 13, 2024 11:03:26.346091032 CET | 58113 | 8877 | 192.168.2.8 | 80.66.76.106 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 13, 2024 10:59:22.337012053 CET | 58431 | 53 | 192.168.2.8 | 1.1.1.1 |
| Nov 13, 2024 10:59:23.354455948 CET | 58431 | 53 | 192.168.2.8 | 1.1.1.1 |
| Nov 13, 2024 10:59:23.428050995 CET | 53 | 58431 | 1.1.1.1 | 192.168.2.8 |
| Nov 13, 2024 10:59:23.428069115 CET | 53 | 58431 | 1.1.1.1 | 192.168.2.8 |
| Nov 13, 2024 10:59:35.451606989 CET | 53 | 55922 | 1.1.1.1 | 192.168.2.8 |
| Nov 13, 2024 10:59:49.109538078 CET | 53 | 52086 | 1.1.1.1 | 192.168.2.8 |
| Nov 13, 2024 11:02:02.907955885 CET | 49645 | 53 | 192.168.2.8 | 1.1.1.1 |
| Nov 13, 2024 11:02:03.095415115 CET | 53 | 49645 | 1.1.1.1 | 192.168.2.8 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Nov 13, 2024 10:59:22.337012053 CET | 192.168.2.8 | 1.1.1.1 | 0x3a16 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Nov 13, 2024 10:59:23.354455948 CET | 192.168.2.8 | 1.1.1.1 | 0x3a16 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Nov 13, 2024 11:02:02.907955885 CET | 192.168.2.8 | 1.1.1.1 | 0x2516 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 13, 2024 10:59:23.428050995 CET | 1.1.1.1 | 192.168.2.8 | 0x3a16 | No error (0) | 80.66.76.106 | A (IP address) | IN (0x0001) | false | ||
| Nov 13, 2024 10:59:23.428069115 CET | 1.1.1.1 | 192.168.2.8 | 0x3a16 | No error (0) | 80.66.76.106 | A (IP address) | IN (0x0001) | false | ||
| Nov 13, 2024 11:02:03.095415115 CET | 1.1.1.1 | 192.168.2.8 | 0x2516 | No error (0) | 172.67.191.232 | A (IP address) | IN (0x0001) | false | ||
| Nov 13, 2024 11:02:03.095415115 CET | 1.1.1.1 | 192.168.2.8 | 0x2516 | No error (0) | 104.21.92.105 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.8 | 58086 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:03 UTC | 411 | OUT | |
| 2024-11-13 10:02:03 UTC | 92 | OUT | |
| 2024-11-13 10:02:05 UTC | 783 | IN | |
| 2024-11-13 10:02:05 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.8 | 58087 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:07 UTC | 410 | OUT | |
| 2024-11-13 10:02:09 UTC | 789 | IN | |
| 2024-11-13 10:02:09 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.8 | 58088 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:10 UTC | 410 | OUT | |
| 2024-11-13 10:02:12 UTC | 793 | IN | |
| 2024-11-13 10:02:12 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.8 | 58089 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:13 UTC | 410 | OUT | |
| 2024-11-13 10:02:15 UTC | 785 | IN | |
| 2024-11-13 10:02:15 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.8 | 58090 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:16 UTC | 410 | OUT | |
| 2024-11-13 10:02:19 UTC | 777 | IN | |
| 2024-11-13 10:02:19 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.8 | 58091 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:20 UTC | 410 | OUT | |
| 2024-11-13 10:02:22 UTC | 783 | IN | |
| 2024-11-13 10:02:22 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.8 | 58092 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:23 UTC | 410 | OUT | |
| 2024-11-13 10:02:24 UTC | 793 | IN | |
| 2024-11-13 10:02:24 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.8 | 58093 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:25 UTC | 410 | OUT | |
| 2024-11-13 10:02:27 UTC | 782 | IN | |
| 2024-11-13 10:02:27 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.8 | 58094 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:28 UTC | 410 | OUT | |
| 2024-11-13 10:02:30 UTC | 781 | IN | |
| 2024-11-13 10:02:30 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.8 | 58095 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:31 UTC | 410 | OUT | |
| 2024-11-13 10:02:33 UTC | 781 | IN | |
| 2024-11-13 10:02:33 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.8 | 58096 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:33 UTC | 414 | OUT | |
| 2024-11-13 10:02:35 UTC | 779 | IN | |
| 2024-11-13 10:02:35 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.8 | 58097 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:36 UTC | 414 | OUT | |
| 2024-11-13 10:02:38 UTC | 791 | IN | |
| 2024-11-13 10:02:38 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.8 | 58098 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:39 UTC | 414 | OUT | |
| 2024-11-13 10:02:41 UTC | 783 | IN | |
| 2024-11-13 10:02:41 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.8 | 58100 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:42 UTC | 414 | OUT | |
| 2024-11-13 10:02:44 UTC | 779 | IN | |
| 2024-11-13 10:02:44 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.8 | 58101 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:45 UTC | 414 | OUT | |
| 2024-11-13 10:02:47 UTC | 783 | IN | |
| 2024-11-13 10:02:47 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.8 | 58102 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:47 UTC | 414 | OUT | |
| 2024-11-13 10:02:49 UTC | 785 | IN | |
| 2024-11-13 10:02:49 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.8 | 58103 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:50 UTC | 414 | OUT | |
| 2024-11-13 10:02:52 UTC | 781 | IN | |
| 2024-11-13 10:02:52 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.8 | 58104 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:53 UTC | 414 | OUT | |
| 2024-11-13 10:02:55 UTC | 783 | IN | |
| 2024-11-13 10:02:55 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.8 | 58105 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:56 UTC | 414 | OUT | |
| 2024-11-13 10:02:58 UTC | 779 | IN | |
| 2024-11-13 10:02:58 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.8 | 58106 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:02:59 UTC | 414 | OUT | |
| 2024-11-13 10:03:01 UTC | 783 | IN | |
| 2024-11-13 10:03:01 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.8 | 58107 | 172.67.191.232 | 443 | 4084 | C:\Windows\explorer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:03:02 UTC | 414 | OUT | |
| 2024-11-13 10:03:04 UTC | 779 | IN | |
| 2024-11-13 10:03:04 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 21 | 192.168.2.8 | 58108 | 172.67.191.232 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:03:05 UTC | 414 | OUT | |
| 2024-11-13 10:03:07 UTC | 785 | IN | |
| 2024-11-13 10:03:07 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 22 | 192.168.2.8 | 58109 | 172.67.191.232 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:03:08 UTC | 414 | OUT | |
| 2024-11-13 10:03:11 UTC | 781 | IN | |
| 2024-11-13 10:03:11 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 23 | 192.168.2.8 | 58110 | 172.67.191.232 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:03:11 UTC | 414 | OUT | |
| 2024-11-13 10:03:14 UTC | 781 | IN | |
| 2024-11-13 10:03:14 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 24 | 192.168.2.8 | 58111 | 172.67.191.232 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:03:15 UTC | 414 | OUT | |
| 2024-11-13 10:03:17 UTC | 783 | IN | |
| 2024-11-13 10:03:17 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 25 | 192.168.2.8 | 58112 | 172.67.191.232 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:03:18 UTC | 414 | OUT | |
| 2024-11-13 10:03:20 UTC | 788 | IN | |
| 2024-11-13 10:03:20 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 26 | 192.168.2.8 | 58114 | 172.67.191.232 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-13 10:03:21 UTC | 414 | OUT | |
| 2024-11-13 10:03:23 UTC | 783 | IN | |
| 2024-11-13 10:03:23 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 04:59:15 |
| Start date: | 13/11/2024 |
| Path: | C:\Windows\System32\msiexec.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff772ad0000 |
| File size: | 69'632 bytes |
| MD5 hash: | E5DA170027542E25EDE42FC54C929077 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 04:59:16 |
| Start date: | 13/11/2024 |
| Path: | C:\Windows\System32\msiexec.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff772ad0000 |
| File size: | 69'632 bytes |
| MD5 hash: | E5DA170027542E25EDE42FC54C929077 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 04:59:16 |
| Start date: | 13/11/2024 |
| Path: | C:\Windows\SysWOW64\msiexec.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xe80000 |
| File size: | 59'904 bytes |
| MD5 hash: | 9D09DC1EDA745A5F87553048E57620CF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 04:59:17 |
| Start date: | 13/11/2024 |
| Path: | C:\Windows\Installer\MSI2701.tmp |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4c0000 |
| File size: | 399'328 bytes |
| MD5 hash: | B9545ED17695A32FACE8C3408A6A3553 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Antivirus matches: |
|
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 04:59:17 |
| Start date: | 13/11/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x540000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 6 |
| Start time: | 04:59:18 |
| Start date: | 13/11/2024 |
| Path: | C:\Windows\System32\rundll32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff653760000 |
| File size: | 71'680 bytes |
| MD5 hash: | EF3179D498793BF4234F708D3BE28633 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | false |
| Target ID: | 11 |
| Start time: | 05:00:41 |
| Start date: | 13/11/2024 |
| Path: | C:\Windows\explorer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff62d7d0000 |
| File size: | 5'141'208 bytes |
| MD5 hash: | 662F4F92FDE3557E86D110526BB578D5 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 1.6% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 38.3% |
| Total number of Nodes: | 389 |
| Total number of Limit Nodes: | 10 |
Graph
Function 004C4BA0 Relevance: 36.5, APIs: 24, Instructions: 502comCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C57C0 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C5E40 Relevance: 4.6, APIs: 3, Instructions: 85COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F70BB Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C52F0 Relevance: 54.7, APIs: 14, Strings: 17, Instructions: 402libraryloadersleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CC870 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 366registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FDE24 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FF032 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FE5B3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C9CC0 Relevance: 7.9, APIs: 5, Instructions: 441COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C2310 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 64memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E33A8 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FE237 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C45B0 Relevance: 4.6, APIs: 3, Instructions: 64COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FE111 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F76AF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E35A9 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FAF79 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FE48A Relevance: 1.6, APIs: 1, Instructions: 83COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FE6B9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E353F Relevance: 1.5, APIs: 1, Instructions: 3COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F0A48 Relevance: .7, Instructions: 655COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F92A9 Relevance: .6, Instructions: 637COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004EA915 Relevance: .4, Instructions: 388COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FD8D5 Relevance: .3, Instructions: 327COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004EC2CA Relevance: .2, Instructions: 158COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E4920 Relevance: .1, Instructions: 76COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FAD78 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F2DCC Relevance: .0, Instructions: 12COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C6600 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 319filememoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E2B8C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E5CAF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C4270 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C3C20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 225libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D8555 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F72FB Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C8610 Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C9270 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CD87C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D22FA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D238F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2424 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D24B9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D254E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D25E3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2678 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CD6BD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DE843 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DE8D8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2961 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D29F6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2A8B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DEA97 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DEB2C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2B20 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2D74 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F2DEE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CB500 Relevance: 9.2, APIs: 6, Instructions: 151memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CB700 Relevance: 9.1, APIs: 6, Instructions: 128memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F0351 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C3230 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 260fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E5A58 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C36D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129libraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C621F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D8451 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C6250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E69E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CD752 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D270D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CD7E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D27A2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2837 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D28CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DE96D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DEA02 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DEBC1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2BB5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2C4A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DEC56 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2CDF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2E09 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2E9E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D2F33 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F6DB9 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CBB40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D8386 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DFFEA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C24C0 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CCCE0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F1A6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CBD90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E6059 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C9070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004CF098 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D0D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004F7559 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C4070 Relevance: 5.2, APIs: 4, Instructions: 189memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C1D80 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 4.2% |
| Dynamic/Decrypted Code Coverage: | 93.7% |
| Signature Coverage: | 12.8% |
| Total number of Nodes: | 650 |
| Total number of Limit Nodes: | 49 |
Graph
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007DF4BD330100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000000018001F790 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A99429CCE0 Relevance: 1.6, APIs: 1, Instructions: 114libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942917B0 Relevance: .4, Instructions: 355COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942C4360 Relevance: .1, Instructions: 138COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942C45F0 Relevance: .1, Instructions: 82COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942C3F40 Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942C4BE0 Relevance: .1, Instructions: 71COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942A7A50 Relevance: .1, Instructions: 69COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942C4FF0 Relevance: .1, Instructions: 68COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942C4740 Relevance: .1, Instructions: 61COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A99428D250 Relevance: .0, Instructions: 43COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A99428D2C0 Relevance: .0, Instructions: 37COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942A8149 Relevance: .0, Instructions: 20COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000000018001F5C0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A994297830 Relevance: 10.8, APIs: 7, Instructions: 340networkmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A9942AF3A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215threadprocessCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A99428BE40 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 317COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001A994298ED0 Relevance: 1.9, APIs: 1, Instructions: 410synchronizationCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800EED50 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0000000180001510 Relevance: 18.1, APIs: 12, Instructions: 130threadmemoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800FA160 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 239COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800FABBC Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800D2C10 Relevance: 9.1, APIs: 6, Instructions: 94libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800DBA64 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800990C0 Relevance: 18.3, APIs: 12, Instructions: 313synchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800EFAF4 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0000000180099560 Relevance: 16.9, APIs: 11, Instructions: 407synchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0000000180041E70 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 170COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800EFF24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800DC260 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800EFC6C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800297E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 216COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800D65BC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800EFD34 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800420E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0000000180014060 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800D6458 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000000018000E1E0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 329COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00000001800D7BA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 11.5% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0.6% |
| Total number of Nodes: | 868 |
| Total number of Limit Nodes: | 10 |
Graph
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEA8E0 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEB388 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18memorynativeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE82B4 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEC704 Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE41B4 Relevance: 9.1, APIs: 6, Instructions: 87COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE8C30 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE545D Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE6C6C Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE2164 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 206pipefileprocessCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE80B8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43filenativeCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE2B28 Relevance: 6.1, APIs: 4, Instructions: 112fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BF00E8 Relevance: .0, Instructions: 36COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEC860 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEBB44 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102fileCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEC5C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEB9A0 Relevance: 7.6, APIs: 5, Instructions: 79processCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|