Edit tour
Windows
Analysis Report
000001 (5).jpg
Overview
General Information
| Sample name: | 000001 (5).jpg |
| Analysis ID: | 1566841 |
| MD5: | 8379568464d8a4253eb8623701ad8c04 |
| SHA1: | 6b457dadfcc171b39fcb2028b4e51aef8f61322f |
| SHA256: | 326390f2e71521df5d9f2e6f49dcb51ec0119faa146c48fe03a78c55f386913f |
| Infos: | |
 | |
Detection
| Score: | 2 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 60% |
Signatures
Allocates memory with a write watch (potentially for evading sandboxes)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64_ra
AccountsControlHost.exe (PID: 1828 cmdline: "C:\Window s\SystemAp ps\Microso ft.Account sControl_c w5n1h2txye wy\Account sControlHo st.exe" -S erverName: App.AppX20 qnn98vxw5b hxrjtb1f6r ggecb2k15a .mca MD5: B5771BB2E606873149277940FFB4BCB5)
- WWAHost.exe (PID: 1228 cmdline:
"C:\Window s\system32 \wwahost.e xe" -Serve rName:App. wwa MD5: 69318AE264A1E45ED570CEDCDC4B7B69)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Security Software Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 2 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 11 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 13 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 1 Ingress Tool Transfer | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| sni1gl.wpc.alphacdn.net | 152.199.21.175 | true | false | high | |
| logincdn.msftauth.net | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 152.199.21.175 | sni1gl.wpc.alphacdn.net | United States | 15133 | EDGECASTUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1566841 |
| Start date and time: | 2024-12-02 18:27:07 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 59s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 17 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 000001 (5).jpg |
| Detection: | CLEAN |
| Classification: | clean2.winJPG@2/16@1/1 |
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, Microsoft.Photos.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 20.190.177.82, 20.190.177.19, 20.190.147.1, 20.190.177.147, 20.190.147.9, 20.190.147.2, 20.190.177.146, 20.190.147.5, 52.168.117.170
- Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, data-edge.smartscreen.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, lgincdnvzeuno.ec.azureedge.net, browser.events.data.trafficmanager.net, nav.smartscreen.microsoft.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, lgincdnvzeuno.azureedge.net, browser.events.data.microsoft.com, login.live.com, onedscolprdeus13.eastus.cloudapp.azure.com, www.tm.lg.prod.aadmsa.trafficmanager.net
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtAllocateVirtualMemory calls found.
- Report size getting too big, too many NtOpenKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: 000001 (5).jpg
| Time | Type | Description |
|---|---|---|
| 12:28:09 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 152.199.21.175 | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| sni1gl.wpc.alphacdn.net | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Lure-BasedAttack, HTMLPhisher | Browse |
| ||
| Get hash | malicious | CredentialStealer | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher, TechSupportScam | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| EDGECASTUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 6271f898ce5be7dd52b0fc260d0662b3 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\72HOFR41\2_11d9e3bcdfede9ce5ce5ace2d129f1c4[1].svg
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1864 |
| Entropy (8bit): | 5.222032823730197 |
| Encrypted: | false |
| SSDEEP: | 48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B |
| MD5: | BC3D32A696895F78C19DF6C717586A5D |
| SHA1: | 9191CB156A30A3ED79C44C0A16C95159E8FF689D |
| SHA-256: | 0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68 |
| SHA-512: | 8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\72HOFR41\Converged_v22057_mG-wAdV--_sq1kXms675SA2[1].css
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 111517 |
| Entropy (8bit): | 5.283488463851382 |
| Encrypted: | false |
| SSDEEP: | 1536:IpHDgan7CPw+kGDazA/PWrF7qvEAFiQcpmFKg0IJ0yVU/9:yIr2yVUF |
| MD5: | 986FB001D57EFBFB2AD645E6B3AEF948 |
| SHA1: | A1590F0BC684D395A6179FB915DEECA3A9321D89 |
| SHA-256: | DE304CB4D64E769DD16A7B4500603205D2606FE0877DD046460C7B8DF06A31B3 |
| SHA-512: | 0C5599773904A45552E241E9E7723BD6CDC0A3B71A05145553942E27450E8E706C128C918FC6B5599F9BB55EEA1FA6B9801D78FD4D95292E24709CD90FB9A7CC |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\72HOFR41\microsoft_logo_564db913a7fa0ca42727161c6d031bef[1].svg
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3651 |
| Entropy (8bit): | 4.094801914706141 |
| Encrypted: | false |
| SSDEEP: | 96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO |
| MD5: | EE5C8D9FB6248C938FD0DC19370E90BD |
| SHA1: | D01A22720918B781338B5BBF9202B241A5F99EE4 |
| SHA-256: | 04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A |
| SHA-512: | C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\GMCXXDTK\Win10HostLogin_PCore_tyc5d-3YkIvD7nbPy0DBHw2[1].js
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 488937 |
| Entropy (8bit): | 5.4510900848603665 |
| Encrypted: | false |
| SSDEEP: | 6144:ZhHgjUNdqa/iL1QLsxBSzJLUUirhl1kVR01Sxk1UuXXTI:ZhAR24uVLcm4k |
| MD5: | B7273977EDD8908BC3EE76CFCB40C11F |
| SHA1: | 39A6DCE4076557A299A17EA14B7CE9C9C6D35EEA |
| SHA-256: | 7D0B46AE9F672462390C00EB25BBFB780B3991E6650D58C4BE803372050C9F4B |
| SHA-512: | 37721FE438B48C5FD5805F2F881C43D210E90A9EEFCD7342226345B548913CC8A12A97B55C1A02B1939C34BC0204FB374C64CC0707F15843B4340CF670125D8B |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\GMCXXDTK\signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6[1].svg
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1592 |
| Entropy (8bit): | 4.205005284721148 |
| Encrypted: | false |
| SSDEEP: | 48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh |
| MD5: | 4E48046CE74F4B89D45037C90576BFAC |
| SHA1: | 4A41B3B51ED787F7B33294202DA72220C7CD2C32 |
| SHA-256: | 8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93 |
| SHA-512: | B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\GOPNT4EG\ConvergedLoginPaginatedStrings.en-gb_xKLYpPR3cTz1G2q-i7i0Kw2[1].js
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 38737 |
| Entropy (8bit): | 5.172420373193738 |
| Encrypted: | false |
| SSDEEP: | 768:qsIjgDKmrFvv91/LBt0joigiNfmWKy+d/Png07NJSDRhAnFFgmhDgQny:q9mrlv91TBt0joigiNfmWKy+d/Png07U |
| MD5: | C4A2D8A4F477713CF51B6ABE8BB8B42B |
| SHA1: | 82A09AF90939776FAB8AB2CF6ABDC793922A64F2 |
| SHA-256: | 00F747E1C02B1B5FE4A3B149DD9E83E766AF2DCBA989B0E7D2CDD347E8541D6C |
| SHA-512: | 9ECE505FDD60E7499DFB0D526D3406F6EB89EB399EBD74EC85EF049B56C865D187AAB11D94987438D771E1A1EAB3A55AE378967DA209D36EC8C82E16ABC1E3D9 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\GOPNT4EG\WinJS_vcvx4TydCFioSeM4NLxTDw2[1].js
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 168824 |
| Entropy (8bit): | 5.403041370649555 |
| Encrypted: | false |
| SSDEEP: | 3072:22KXX5H23sda+tLIQP2aBHAHnAEA/9zL9zt6R2f2mfzN:22K9B5ns2/ |
| MD5: | BDCBF1E13C9D0858A849E33834BC530F |
| SHA1: | 5CFEBACFF659D5304E551EE5CB856557DA4209DD |
| SHA-256: | 3989FE38739BBA3E3DD9D60C4364D9DCCA55F44A1B1786DE77F97F17CA0EF21B |
| SHA-512: | 4EA4FE3058DBDCF3E4A876F30624CA9D7E3B98AE60A2DFD28892D0615674DFE95229AA65AD25DB2C0E2BAFF988EED7114128118156EE6AE1910B9E6C7CF6E513 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49120 |
| Entropy (8bit): | 0.0017331682157558962 |
| Encrypted: | false |
| SSDEEP: | 3:Ztt:T |
| MD5: | 0392ADA071EB68355BED625D8F9695F3 |
| SHA1: | 777253141235B6C6AC92E17E297A1482E82252CC |
| SHA-256: | B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7 |
| SHA-512: | EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\RE0I21MA\Converged_v22057_mG-wAdV--_sq1kXms675SA2[1].css
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 111517 |
| Entropy (8bit): | 5.283488463851382 |
| Encrypted: | false |
| SSDEEP: | 1536:IpHDgan7CPw+kGDazA/PWrF7qvEAFiQcpmFKg0IJ0yVU/9:yIr2yVUF |
| MD5: | 986FB001D57EFBFB2AD645E6B3AEF948 |
| SHA1: | A1590F0BC684D395A6179FB915DEECA3A9321D89 |
| SHA-256: | DE304CB4D64E769DD16A7B4500603205D2606FE0877DD046460C7B8DF06A31B3 |
| SHA-512: | 0C5599773904A45552E241E9E7723BD6CDC0A3B71A05145553942E27450E8E706C128C918FC6B5599F9BB55EEA1FA6B9801D78FD4D95292E24709CD90FB9A7CC |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\RE0I21MA\marching_ants_986f40b5a9dc7d39ef8396797f61b323[1].gif
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3620 |
| Entropy (8bit): | 6.867828878374734 |
| Encrypted: | false |
| SSDEEP: | 48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd |
| MD5: | B540A8E518037192E32C4FE58BF2DBAB |
| SHA1: | 3047C1DB97B86F6981E0AD2F96AF40CDF43511AF |
| SHA-256: | 8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D |
| SHA-512: | E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\RE0I21MA\marching_ants_white_8257b0707cbe1d0bd2661b80068676fe[1].gif
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2672 |
| Entropy (8bit): | 6.640973516071413 |
| Encrypted: | false |
| SSDEEP: | 48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/ |
| MD5: | 166DE53471265253AB3A456DEFE6DA23 |
| SHA1: | 17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D |
| SHA-256: | A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13 |
| SHA-512: | 80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\RE0I21MA\oneDs_f2e0f4a029670f10d892[1].js
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 190152 |
| Entropy (8bit): | 5.348678574819375 |
| Encrypted: | false |
| SSDEEP: | 3072:0+mTq9mTuZEOHEXp6WXWkYVlMBMwMlJNbdffVv6GhL+rUWxa:STekBWkYVdLlJNbr6m+rUGa |
| MD5: | 4877EFC88055D60953886EC55B04DE34 |
| SHA1: | 2341B026A3E2A3B01AFA1A39D1706840D75E09B3 |
| SHA-256: | 8405362EB8F09DF13AE244DE155B51B1577274673D9728B6C81CD0278A63C8B0 |
| SHA-512: | 625844EDC37594D5C2F7622BD1B59278BF68ABB2FA22476C56826433C961C7B1924858A7588F8B6284D3C5AC8738ECB895EEC949DE18667A98C04A59CB03DAC0 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J7E7MWJW\login.live[1].xml
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13 |
| Entropy (8bit): | 2.469670487371862 |
| Encrypted: | false |
| SSDEEP: | 3:D90aKb:JFKb |
| MD5: | C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 |
| SHA1: | 35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966 |
| SHA-256: | B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB |
| SHA-512: | 6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RLLV1W2J\microsoft.windows[1].xml
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13 |
| Entropy (8bit): | 2.469670487371862 |
| Encrypted: | false |
| SSDEEP: | 3:D90aKb:JFKb |
| MD5: | C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 |
| SHA1: | 35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966 |
| SHA-256: | B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB |
| SHA-512: | 6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8192 |
| Entropy (8bit): | 0.8083251803572817 |
| Encrypted: | false |
| SSDEEP: | 24:x74WVKn6lDuUbwB7nigw/+wB7kLpOhnaHCZnWsR:dJs+87Y7kD |
| MD5: | 488B5EEC7186AB4F311ADF6D6A6F6351 |
| SHA1: | FEEFD119F0726D36A714CF59FE41E2A36692EAC7 |
| SHA-256: | 3166FC22C1277651F68B7D272C3FA07E4BD15768BB5E259B107F05432629D795 |
| SHA-512: | 7E80245E46A727B1E0387D39D0A7351780DEFEEE90D8AFC952A2A38AA6778CA428F21D1189893B4D7196EBCCFB91F7FFCDB0C5C1147CC5EDDCF95D409B9D4484 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
Download File
| Process: | C:\Windows\System32\WWAHost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8192 |
| Entropy (8bit): | 0.8478425417406572 |
| Encrypted: | false |
| SSDEEP: | 24:J174WirG17n6lDuUbwB7nigw/+wB7kLpOhnaHCZnWsR:bJWUj+87Y7kD |
| MD5: | 9BD6518B073A5C1DE6E505DF7C644C3B |
| SHA1: | E5FA9DE2A5CF8FDD88C25B9F16AD2A20F381C61F |
| SHA-256: | E74A9F299A56434663695F49189A44A05152B50F50B61B77968FFD06EE260E03 |
| SHA-512: | A45492D981C4000E43456B56E03593A5A43C78574B0445300219503D8565642404AA42E8A537A8FC666D5EC6360A1527A5E02960CBDC85ADED775F785E5331D7 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 4.011801808000533 |
| TrID: |
|
| File name: | 000001 (5).jpg |
| File size: | 203 bytes |
| MD5: | 8379568464d8a4253eb8623701ad8c04 |
| SHA1: | 6b457dadfcc171b39fcb2028b4e51aef8f61322f |
| SHA256: | 326390f2e71521df5d9f2e6f49dcb51ec0119faa146c48fe03a78c55f386913f |
| SHA512: | 21c3380f4c83c4b2a3222fdaf119d1fe93ad0802fc9882f6108c57063b39ef00736b532d467ca7fbf8a16457c7b721cae7e3e01a66e47924ca106998d0a55908 |
| SSDEEP: | 3:nStkblB3mTxtB+WY8HGHQAM85ZJlWTqTtBhhk//skklAalf8:dbb36OW/mfM8plWTqRXhjkklq |
| TLSH: | 36D02B4B2E05BD04CD422F3445332D38134418131E21978903C17D1C3C4CDC000212D1 |
| File Content Preview: | ......JFIF.....d.d.....C................................... $.' ",#..(7),01444.'9=82<.342......d.d.........................................................?............................................?.. |
 | |
| Icon Hash: | 74f0f0e4c6d6e0e4 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 2, 2024 18:28:14.608072042 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:14.608114004 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:14.608201027 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:14.608530998 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:14.608544111 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.401627064 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.401770115 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:16.405695915 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:16.405710936 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.405829906 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:16.405837059 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.405945063 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.406002998 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:16.910537004 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.910626888 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:16.961030960 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.961052895 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.961081982 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.961133957 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:16.961163044 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:16.961182117 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:16.961225986 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.139345884 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.139367104 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.139458895 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.139483929 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.139537096 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.179924011 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.179941893 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.180035114 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.180064917 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.180120945 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.306103945 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.306128025 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.306237936 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.306271076 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.306324005 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.335145950 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.335177898 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.335288048 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.335325956 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.335375071 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.358181000 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.358197927 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.358295918 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.358319998 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.358366013 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.375963926 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.376009941 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.376048088 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.376063108 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.376111031 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.376247883 CET | 49710 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.376267910 CET | 443 | 49710 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.572983027 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.573030949 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:17.573124886 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.573517084 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:17.573529959 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.393224955 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.393347979 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:19.396612883 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:19.396630049 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.396760941 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:19.396769047 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.396907091 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.396959066 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:19.910592079 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.910681963 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:19.967585087 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.967595100 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.967644930 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.967674971 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:19.967691898 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:19.967711926 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:19.967742920 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.155874014 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.155904055 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.156059027 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.156101942 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.156147003 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.234086037 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.234112978 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.234226942 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.234257936 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.234302998 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.336302042 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.336335897 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.336800098 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.336831093 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.336880922 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.373452902 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.373485088 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.373615980 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.373650074 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.373698950 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.395457983 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.395482063 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.395641088 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.395652056 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.395697117 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.411624908 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.411712885 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.411731958 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.411761045 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.411822081 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.414625883 CET | 49711 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.414659977 CET | 443 | 49711 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.475663900 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.475719929 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.475852966 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.477758884 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.477770090 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.479532003 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.479593039 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:20.479676008 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.481333971 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:20.481345892 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.347661018 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.347781897 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.348321915 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.348331928 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.348622084 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.348627090 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.349575996 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.349677086 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.349984884 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.349993944 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.350842953 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.350847006 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.880337000 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.880434990 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.881663084 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.881721020 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.930327892 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.930341005 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.930385113 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.930437088 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.930459023 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.930494070 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.930512905 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.932033062 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.932041883 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.932068110 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.932120085 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.932147026 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:22.932158947 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:22.932193041 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.126969099 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.126992941 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.127135038 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.127171040 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.127233028 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.131705999 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.131730080 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.131804943 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.131839037 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.131865025 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.131885052 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.154608965 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.154689074 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.154710054 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.154747009 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.154824018 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.154843092 CET | 443 | 49713 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.154855013 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.154882908 CET | 49713 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.169648886 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.169677973 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.169740915 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.169754982 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.169800997 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.169816971 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.316570997 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.316603899 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.316754103 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.316775084 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.316843987 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.469880104 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.469906092 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.470042944 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.470079899 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.470151901 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.494879007 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.494901896 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.494993925 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.495007992 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.495052099 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.523742914 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.523766994 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.523848057 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.523860931 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.523905039 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.551789999 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.551819086 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.551929951 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.551943064 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.551987886 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.576441050 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.576462984 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.576571941 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.576611996 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.576663017 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.606637955 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.606663942 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.606760025 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.606774092 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.606847048 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.613847971 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.613943100 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.613945961 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.613992929 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.614052057 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.614075899 CET | 443 | 49712 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.614093065 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.614120960 CET | 49712 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.682616949 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.682682037 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:23.682826042 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.683093071 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:23.683104992 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:25.498089075 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:25.498202085 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:25.498657942 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:25.498673916 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:25.498898983 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:25.498904943 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.022820950 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.022895098 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.065432072 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.065440893 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.065485001 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.065532923 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.065548897 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.065587997 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.065608025 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.264733076 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.264764071 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.264950991 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.264970064 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.265010118 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.311913967 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.311939955 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.312057972 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.312066078 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.312102079 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.667526007 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.667540073 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.667593002 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.667635918 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.667664051 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.667694092 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.667711973 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.673306942 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.673325062 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.673374891 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.673382044 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.673413038 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.673432112 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.679193974 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.679213047 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.679332972 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.679341078 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.679389954 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.686062098 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.686078072 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.686146021 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.686158895 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.686204910 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.691832066 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.691848993 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.691915989 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.691925049 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.691971064 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.801479101 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.801498890 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.801584005 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.801626921 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.801640034 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.801673889 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.826025009 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.826047897 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.826097965 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.826126099 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.826143026 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.826167107 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.844593048 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.844610929 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.844790936 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.844815016 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.844924927 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.864284992 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.864303112 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.864460945 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.864469051 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.864559889 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.885317087 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.885334969 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.885467052 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.885473967 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.885535955 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.901665926 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.901686907 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.901901007 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.901910067 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.901993990 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.921792030 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.921812057 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.921885014 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.921895027 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.921941042 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.939829111 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.939846039 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.939884901 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.939934969 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.939945936 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.939990997 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.960011005 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.960030079 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.960098982 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.960125923 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.960143089 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.960181952 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.981663942 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.981687069 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.981766939 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.981795073 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.981838942 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.996922970 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.996947050 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.997010946 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.997023106 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:26.997056007 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:26.997087002 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.038796902 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.038815975 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.039011955 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.039041042 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.039091110 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.049523115 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.049540997 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.049638033 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.049659967 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.049711943 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.056809902 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.056824923 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.056895971 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.056904078 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.056952000 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.064125061 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.064141035 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.064215899 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.064237118 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.064287901 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.070751905 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.070766926 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.070836067 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.070843935 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.070885897 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.077320099 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.077341080 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.077418089 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.077425957 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.077469110 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.083848953 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.083863020 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.083933115 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.083954096 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.083996058 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.090607882 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.090622902 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.090703964 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.090720892 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.090770960 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.097157001 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.097172976 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.097259998 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.097282887 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.097330093 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.105488062 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.105503082 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.105581045 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.105590105 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.105640888 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.110398054 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.110452890 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.110476971 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.110486984 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.110517025 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.110534906 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.110660076 CET | 49714 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.110677004 CET | 443 | 49714 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.214473963 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.214530945 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:27.214646101 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.214915037 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:27.214935064 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.088098049 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.088200092 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.088768959 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.088783979 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.089015007 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.089024067 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.622518063 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.622625113 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.670159101 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.670167923 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.670221090 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.670248032 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.670264006 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.670289040 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.670312881 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.866050959 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.866074085 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.866190910 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.866226912 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.866307020 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.905976057 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.905996084 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.906071901 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:29.906085014 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:29.906130075 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.056180954 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.056200981 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.056369066 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.056404114 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.056485891 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.081343889 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.081366062 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.081497908 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.081507921 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.081577063 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.101913929 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.101933956 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.102077961 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.102087021 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.102165937 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.121499062 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.121515036 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.121661901 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.121673107 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.121751070 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.259999037 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.260023117 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.260091066 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.260119915 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.260170937 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.260190010 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.278580904 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.278599977 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.278672934 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.278698921 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.278747082 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.295773029 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.295790911 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.295875072 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.295886040 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.295955896 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.306823969 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.306843042 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.306904078 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.306914091 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.306969881 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.306993961 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.313683033 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.313733101 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.313752890 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.313774109 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.313810110 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.313955069 CET | 49716 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.313972950 CET | 443 | 49716 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.655133009 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.655172110 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.655289888 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.655601978 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.655615091 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.658667088 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.658731937 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:30.658813000 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.659090996 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:30.659106016 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.437905073 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.437983036 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.439232111 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.439249992 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.439558983 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.439565897 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.550748110 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.550832987 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.551230907 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.551246881 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.551532030 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.551537037 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.957876921 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.957945108 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.958936930 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.958993912 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:32.959002018 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:32.959044933 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.096695900 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:33.096769094 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.097034931 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:33.097081900 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.097094059 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:33.097107887 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:33.097137928 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.097167969 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.120104074 CET | 49717 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.120105982 CET | 49718 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.120122910 CET | 443 | 49717 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:33.120142937 CET | 443 | 49718 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:33.135442019 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.135464907 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:33.135535955 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.135833025 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:33.135849953 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:34.979619026 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:34.979691982 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:34.981379986 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:34.981390953 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:34.981869936 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:34.981874943 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:35.504698992 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:35.504785061 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:35.504944086 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:35.504997969 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:35.505003929 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:35.505049944 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:35.505052090 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:35.505099058 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:35.505812883 CET | 49719 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:35.505826950 CET | 443 | 49719 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:51.614437103 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:51.614496946 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:51.614603996 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:51.614654064 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:51.614708900 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:51.614778042 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:51.614887953 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:51.614900112 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:51.615008116 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:51.615025043 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.429187059 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.429307938 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.429816008 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.429827929 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.430085897 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.430092096 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.430305004 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.430366039 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.430746078 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.430752993 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.430974960 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.430979967 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.953087091 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.953176975 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.953238964 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.953295946 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.953301907 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.953351974 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.954087019 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.954149008 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.954421997 CET | 49720 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.954446077 CET | 443 | 49720 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.955410004 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.955461979 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.955471992 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.955507040 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.955545902 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.955563068 CET | 443 | 49721 | 152.199.21.175 | 192.168.2.16 |
| Dec 2, 2024 18:28:53.955573082 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Dec 2, 2024 18:28:53.955624104 CET | 49721 | 443 | 192.168.2.16 | 152.199.21.175 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 2, 2024 18:28:14.466284990 CET | 64877 | 53 | 192.168.2.16 | 1.1.1.1 |
| Dec 2, 2024 18:28:14.607167006 CET | 53 | 64877 | 1.1.1.1 | 192.168.2.16 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 2, 2024 18:28:14.466284990 CET | 192.168.2.16 | 1.1.1.1 | 0x3b07 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 2, 2024 18:28:14.607167006 CET | 1.1.1.1 | 192.168.2.16 | 0x3b07 | No error (0) | scdn38c07.wpc.9da5e.alphacdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 2, 2024 18:28:14.607167006 CET | 1.1.1.1 | 192.168.2.16 | 0x3b07 | No error (0) | sni1gl.wpc.alphacdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 2, 2024 18:28:14.607167006 CET | 1.1.1.1 | 192.168.2.16 | 0x3b07 | No error (0) | 152.199.21.175 | A (IP address) | IN (0x0001) | false | ||
| Dec 2, 2024 18:28:17.571934938 CET | 1.1.1.1 | 192.168.2.16 | 0x5ccd | No error (0) | sni1gl.wpc.alphacdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 2, 2024 18:28:17.571934938 CET | 1.1.1.1 | 192.168.2.16 | 0x5ccd | No error (0) | 152.199.21.175 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.16 | 49710 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:16 UTC | 563 | OUT | |
| 2024-12-02 17:28:16 UTC | 735 | IN | |
| 2024-12-02 17:28:16 UTC | 15667 | IN | |
| 2024-12-02 17:28:17 UTC | 16383 | IN | |
| 2024-12-02 17:28:17 UTC | 16383 | IN | |
| 2024-12-02 17:28:17 UTC | 16383 | IN | |
| 2024-12-02 17:28:17 UTC | 16383 | IN | |
| 2024-12-02 17:28:17 UTC | 16383 | IN | |
| 2024-12-02 17:28:17 UTC | 13935 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.16 | 49711 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:19 UTC | 601 | OUT | |
| 2024-12-02 17:28:19 UTC | 735 | IN | |
| 2024-12-02 17:28:19 UTC | 16383 | IN | |
| 2024-12-02 17:28:20 UTC | 16383 | IN | |
| 2024-12-02 17:28:20 UTC | 2 | IN | |
| 2024-12-02 17:28:20 UTC | 16383 | IN | |
| 2024-12-02 17:28:20 UTC | 16383 | IN | |
| 2024-12-02 17:28:20 UTC | 16383 | IN | |
| 2024-12-02 17:28:20 UTC | 16383 | IN | |
| 2024-12-02 17:28:20 UTC | 4 | IN | |
| 2024-12-02 17:28:20 UTC | 13213 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.16 | 49712 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:22 UTC | 547 | OUT | |
| 2024-12-02 17:28:22 UTC | 751 | IN | |
| 2024-12-02 17:28:22 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 2 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 6 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.16 | 49713 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:22 UTC | 578 | OUT | |
| 2024-12-02 17:28:22 UTC | 749 | IN | |
| 2024-12-02 17:28:22 UTC | 16383 | IN | |
| 2024-12-02 17:28:22 UTC | 1 | IN | |
| 2024-12-02 17:28:23 UTC | 16383 | IN | |
| 2024-12-02 17:28:23 UTC | 5970 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.16 | 49714 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:25 UTC | 566 | OUT | |
| 2024-12-02 17:28:26 UTC | 750 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 1 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN | |
| 2024-12-02 17:28:26 UTC | 16383 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.16 | 49716 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:29 UTC | 548 | OUT | |
| 2024-12-02 17:28:29 UTC | 751 | IN | |
| 2024-12-02 17:28:29 UTC | 16383 | IN | |
| 2024-12-02 17:28:29 UTC | 16383 | IN | |
| 2024-12-02 17:28:29 UTC | 16383 | IN | |
| 2024-12-02 17:28:30 UTC | 16383 | IN | |
| 2024-12-02 17:28:30 UTC | 16383 | IN | |
| 2024-12-02 17:28:30 UTC | 16383 | IN | |
| 2024-12-02 17:28:30 UTC | 16383 | IN | |
| 2024-12-02 17:28:30 UTC | 16383 | IN | |
| 2024-12-02 17:28:30 UTC | 16383 | IN | |
| 2024-12-02 17:28:30 UTC | 16383 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.16 | 49718 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:32 UTC | 618 | OUT | |
| 2024-12-02 17:28:32 UTC | 738 | IN | |
| 2024-12-02 17:28:32 UTC | 3651 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.16 | 49717 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:32 UTC | 617 | OUT | |
| 2024-12-02 17:28:33 UTC | 738 | IN | |
| 2024-12-02 17:28:33 UTC | 1864 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.16 | 49719 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:34 UTC | 618 | OUT | |
| 2024-12-02 17:28:35 UTC | 738 | IN | |
| 2024-12-02 17:28:35 UTC | 1592 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.16 | 49720 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:53 UTC | 623 | OUT | |
| 2024-12-02 17:28:53 UTC | 716 | IN | |
| 2024-12-02 17:28:53 UTC | 2672 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.16 | 49721 | 152.199.21.175 | 443 | 1228 | C:\Windows\System32\WWAHost.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-02 17:28:53 UTC | 617 | OUT | |
| 2024-12-02 17:28:53 UTC | 716 | IN | |
| 2024-12-02 17:28:53 UTC | 3620 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 12 |
| Start time: | 12:28:05 |
| Start date: | 02/12/2024 |
| Path: | C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7f2d60000 |
| File size: | 585'528 bytes |
| MD5 hash: | B5771BB2E606873149277940FFB4BCB5 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 13 |
| Start time: | 12:28:09 |
| Start date: | 02/12/2024 |
| Path: | C:\Windows\System32\WWAHost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff74db50000 |
| File size: | 995'672 bytes |
| MD5 hash: | 69318AE264A1E45ED570CEDCDC4B7B69 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
⊘No disassembly