Edit tour
Windows
Analysis Report
izCOFC8OWh.exe
Overview
General Information
| Sample name: | izCOFC8OWh.exerenamed because original name is a hash value |
| Original sample name: | 8513d85822ec820592542026eca0fd8b71cacf15e2d9d3c8a6d564c7899dcf90.exe |
| Analysis ID: | 1569325 |
| MD5: | d7326ecb2bda34ba1dc81c821e6f32af |
| SHA1: | 59362f6d162758adf219397bcc11c80ad0ca8fc3 |
| SHA256: | 8513d85822ec820592542026eca0fd8b71cacf15e2d9d3c8a6d564c7899dcf90 |
| Tags: | exeuser-adrian__luca |
| Infos: |  |
 | |
Detection
| Score: | 84 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Creates an undocumented autostart registry key
Deletes itself after installation
Machine Learning detection for dropped file
Machine Learning detection for sample
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
HTML page contains string obfuscation
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Explorer Process Tree Break
Sigma detected: Use NTFS Short Name in Command Line
Uses 32bit PE files
Classification
- System is w10x64
izCOFC8OWh.exe (PID: 1936 cmdline: "C:\Users\ user\Deskt op\izCOFC8 OWh.exe" MD5: D7326ECB2BDA34BA1DC81C821E6F32AF) - webcam_plugin.exe (PID: 2144 cmdline:
C:\Users\u ser\AppDat a\Roaming\ webcam_plu gin.exe MD5: 3DF8C3A266B8A05D3165884FEDA0972A) - webcam_plugin.exe (PID: 1804 cmdline:
C:\Users\u ser\AppDat a\Roaming\ Microsot_C entre\webc am_plugin. exe MD5: 3DF8C3A266B8A05D3165884FEDA0972A) - webcam_plugin.exe (PID: 5172 cmdline:
C:\Users\u ser\AppDat a\Roaming\ Microsot_C entre\webc am_plugin. exe MD5: 3DF8C3A266B8A05D3165884FEDA0972A) 
cmd.exe (PID: 5236 cmdline: C:\Windows \system32\ cmd.exe /c ERRORR~1. BAT MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
explorer.exe (PID: 3776 cmdline: explorer h ttp://ukrn ic.com/~fr eexp/index .php MD5: DD6597597673F72E10C9DE7901FBA0A8) - cmd.exe (PID: 1340 cmdline:
C:\Windows \system32\ cmd.exe /c UNISTA~1. BAT MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 4208 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 1908 cmdline:
C:\Windows \system32\ cmd.exe /c UNISTA~1. BAT MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1136 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- explorer.exe (PID: 2196 cmdline:
C:\Windows \explorer. exe /facto ry,{75dff2 b7-6936-4c 06-a8bb-67 6a7b00b24b } -Embeddi ng MD5: 662F4F92FDE3557E86D110526BB578D5) 
chrome.exe (PID: 3476 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t http://u krnic.com/ ~freexp/in dex.php MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 1616 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2156 --fi eld-trial- handle=198 0,i,615210 1684222983 417,879622 5915089315 324,262144 --disable -features= Optimizati onGuideMod elDownload ing,Optimi zationHint s,Optimiza tionHintsF etching,Op timization TargetPred iction /pr efetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber: | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | Static PE information: | ||
| Source: | IP Address: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Process created: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File deleted: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | Windows Management Instrumentation | 1 Scripting | 11 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Security Software Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 Registry Run Keys / Startup Folder | 1 Registry Run Keys / Startup Folder | 21 Virtualization/Sandbox Evasion | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | 1 DLL Side-Loading | 11 Process Injection | Security Account Manager | 21 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | 2 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 File Deletion | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 97% | ReversingLabs | Win32.Trojan.Dacic | ||
| 100% | Avira | TR/Crypt.ASPM.Gen | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | TR/Crypt.ASPM.Gen | ||
| 100% | Avira | TR/Crypt.ASPM.Gen | ||
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| get.mycounter.ua | 62.149.0.249 | true | false | unknown | |
| www.google.com | 142.250.181.68 | true | false | high | |
| ukrnic.com | 91.197.17.8 | true | false | unknown | |
| ax-0001.ax-msedge.net | 150.171.28.10 | true | false | high | |
| fp2e7a.wpc.phicdn.net | 192.229.221.95 | true | false | high | |
| savudenko.org | unknown | unknown | false | unknown | |
| mh29.mobyhost.ru | unknown | unknown | false | unknown | |
| sava80.co.ua | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 62.149.0.249 | get.mycounter.ua | Ukraine | 15497 | COLOCALLInternetDataCenterColoCALLUA | false | |
| 91.197.17.8 | ukrnic.com | Ukraine | 43320 | ASTRATELKOM-ASUA | false | |
| 142.250.181.68 | www.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1569325 |
| Start date and time: | 2024-12-05 18:02:49 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 11s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 25 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | izCOFC8OWh.exerenamed because original name is a hash value |
| Original Sample Name: | 8513d85822ec820592542026eca0fd8b71cacf15e2d9d3c8a6d564c7899dcf90.exe |
| Detection: | MAL |
| Classification: | mal84.winEXE@37/49@15/4 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 173.194.220.84, 172.217.17.78, 23.218.208.109, 172.217.17.67, 34.104.35.123
- Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
- Execution Graph export aborted for target webcam_plugin.exe, PID 1804 because there are no executed function
- Execution Graph export aborted for target webcam_plugin.exe, PID 5172 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: izCOFC8OWh.exe
| Time | Type | Description |
|---|---|---|
| 12:03:41 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Amadey, Stealc, Vidar | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Phorpiex, RHADAMANTHYS, Xmrig | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | TechSupportScam | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| 62.149.0.249 | Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| get.mycounter.ua | Get hash | malicious | Unknown | Browse |
| |
| fp2e7a.wpc.phicdn.net | Get hash | malicious | FormBook, GuLoader | Browse |
| |
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| ax-0001.ax-msedge.net | Get hash | malicious | FormBook, GuLoader | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RedLine, Snake Keylogger, VIP Keylogger, XWorm | Browse |
| ||
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| COLOCALLInternetDataCenterColoCALLUA | Get hash | malicious | GuLoader, RHADAMANTHYS | Browse |
| |
| Get hash | malicious | GuLoader, RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | GuLoader, RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Remcos, RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook, GuLoader | Browse |
| ||
| Get hash | malicious | FormBook, GuLoader | Browse |
| ||
| Get hash | malicious | FormBook, GuLoader | Browse |
|
⊘No context
⊘No context
| Process: | C:\Users\user\AppData\Roaming\Microsot_Centre\webcam_plugin.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 88836 |
| Entropy (8bit): | 5.912663764479893 |
| Encrypted: | false |
| SSDEEP: | 1536:NJVxqmQSMvEhyEwhND3ugqqM/D2XkQ5XRBMtxjMSmnaR:NzftMvLdnD3ZFK2XL57MtxNR |
| MD5: | 3DF8C3A266B8A05D3165884FEDA0972A |
| SHA1: | 40512A38AF7381C44F3B7CEEF9B23AE8AAE5A406 |
| SHA-256: | 7313DE176B715480DBAC1A071B7487B14D19955D3EDAEAEC83B51A7872C9AC2E |
| SHA-512: | A37A92F4049DBCF9D3337BC94105BD4C3C4C4AF0C580206C370D0758AF4B826850B01D284551C5D0A3005D7AEE883170E3C071639BB8AFDD5F2BE6C724971B9D |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Roaming\Microsot_Centre\webcam_plugin.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 88836 |
| Entropy (8bit): | 5.912663764479893 |
| Encrypted: | false |
| SSDEEP: | 1536:NJVxqmQSMvEhyEwhND3ugqqM/D2XkQ5XRBMtxjMSmnaR:NzftMvLdnD3ZFK2XL57MtxNR |
| MD5: | 3DF8C3A266B8A05D3165884FEDA0972A |
| SHA1: | 40512A38AF7381C44F3B7CEEF9B23AE8AAE5A406 |
| SHA-256: | 7313DE176B715480DBAC1A071B7487B14D19955D3EDAEAEC83B51A7872C9AC2E |
| SHA-512: | A37A92F4049DBCF9D3337BC94105BD4C3C4C4AF0C580206C370D0758AF4B826850B01D284551C5D0A3005D7AEE883170E3C071639BB8AFDD5F2BE6C724971B9D |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Roaming\webcam_plugin.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 88836 |
| Entropy (8bit): | 5.912663764479893 |
| Encrypted: | false |
| SSDEEP: | 1536:NJVxqmQSMvEhyEwhND3ugqqM/D2XkQ5XRBMtxjMSmnaR:NzftMvLdnD3ZFK2XL57MtxNR |
| MD5: | 3DF8C3A266B8A05D3165884FEDA0972A |
| SHA1: | 40512A38AF7381C44F3B7CEEF9B23AE8AAE5A406 |
| SHA-256: | 7313DE176B715480DBAC1A071B7487B14D19955D3EDAEAEC83B51A7872C9AC2E |
| SHA-512: | A37A92F4049DBCF9D3337BC94105BD4C3C4C4AF0C580206C370D0758AF4B826850B01D284551C5D0A3005D7AEE883170E3C071639BB8AFDD5F2BE6C724971B9D |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Roaming\webcam_plugin.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Roaming\webcam_plugin.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 88 |
| Entropy (8bit): | 4.96155051036315 |
| Encrypted: | false |
| SSDEEP: | 3:So+rHyikwL4gSNhFHznkwL4g4qsDArHw1NTzYhKovn:S/Hyik+4gSNh9znk+4g4KHw1NTzYhKyn |
| MD5: | 26199B59CEF06027DB6F39366619D6D6 |
| SHA1: | 0A19890F82523ED503E768824147972F315D57F4 |
| SHA-256: | 32B4E655A8B984235FEDD1EF4AAE003FB275F6E897E2843C126A240C01D2A53C |
| SHA-512: | C91553C9539703DE26D37D20544FF214DD0473ECD3AA73981B5F45F08274C885DA6C55A491272537C139001BB7E93882E83B432A95D0A711B5C715057AF9C370 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\izCOFC8OWh.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 88836 |
| Entropy (8bit): | 5.912663764479893 |
| Encrypted: | false |
| SSDEEP: | 1536:NJVxqmQSMvEhyEwhND3ugqqM/D2XkQ5XRBMtxjMSmnaR:NzftMvLdnD3ZFK2XL57MtxNR |
| MD5: | 3DF8C3A266B8A05D3165884FEDA0972A |
| SHA1: | 40512A38AF7381C44F3B7CEEF9B23AE8AAE5A406 |
| SHA-256: | 7313DE176B715480DBAC1A071B7487B14D19955D3EDAEAEC83B51A7872C9AC2E |
| SHA-512: | A37A92F4049DBCF9D3337BC94105BD4C3C4C4AF0C580206C370D0758AF4B826850B01D284551C5D0A3005D7AEE883170E3C071639BB8AFDD5F2BE6C724971B9D |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\izCOFC8OWh.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Roaming\Microsot_Centre\webcam_plugin.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 69 |
| Entropy (8bit): | 4.564621195720475 |
| Encrypted: | false |
| SSDEEP: | 3:4jRVf2iLB1KKQHy8gHMwVKBGyn:4t/7UHy8gsg6n |
| MD5: | 52B14C41247D9F9B80353FEF0E7FE994 |
| SHA1: | E979D7F56DAB3398F813D2946D2657C408AE4125 |
| SHA-256: | BEE996E03394439179BBD79AA2DE132F5B901075F0212E40036CB8C92E1A1197 |
| SHA-512: | C303A8A07C6148C1700715052C0EA415FDB0CA90DD794DAF81438F9D78EA89A97519E5ED44D4BCF2171EC2DF7C28897F51AFD3514B1664A940A9439917B5B6AF |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\izCOFC8OWh.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 88 |
| Entropy (8bit): | 4.8720386132769455 |
| Encrypted: | false |
| SSDEEP: | 3:So+rHs/mqj1L47NhFH5Y1L41qsDArHw1NTzYhKovn:S/HsuqjB47Nh95YB41KHw1NTzYhKyn |
| MD5: | 26461A2E9E7AF8F50998898268F66363 |
| SHA1: | A728DE14E9D122CA6C8EF279D86937C43424FD25 |
| SHA-256: | E16529170CAF314E7FD6B267090CCD66AA4C06247AB17B84EEF070355E50A7BA |
| SHA-512: | 3143B3BB93F02F760DDCADEB9F8418C3F38C5B0B28BE2FE8FA5E94D6F1D3C640A450B2E66B84722D3BEF1537D67A42771BF828D330B3AE93C046F623718147F2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1339 |
| Entropy (8bit): | 6.450737433708996 |
| Encrypted: | false |
| SSDEEP: | 24:7K1hpunQWwjx82lY2T32HEVrSKKcyJ3VZHK0UmlG+OhOLHyp6cPGCh:sitNn2VgJ3GEChOLyp6cP5 |
| MD5: | 0324663849AD24E87F11AC1D6516320F |
| SHA1: | 37CEAFDAC709E5818089BA53787C9B517C36A67C |
| SHA-256: | 20B89C628474D9E755331C942445AE271E7664855B4CF6F263D8B2105B124A57 |
| SHA-512: | EC696DC3FE375AC76ADCB89CB36B52B23DB092C24559A8130DB6F7CB218E90C081D25C12D581C66A4B247CF1FE313C42C39AD37D9DCB6A00170BF9C63E468F37 |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/images/head_l.jpg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 96190 |
| Entropy (8bit): | 5.204592287727612 |
| Encrypted: | false |
| SSDEEP: | 1536:m05y+RkV1zWQGPe2Yw3kub7wwxFLn0IR0HoKcu3RiiHf3ma8yAJYMye:S+jTi2u3EiHf3ma0Jrye |
| MD5: | 0595E298FE7D89DBA01F17568493A734 |
| SHA1: | B2099FDD5B5D744FBB5DE8B3F0618C522F4CE44D |
| SHA-256: | 54A82CB12E6E213C3B94FB1674617997E730F8FB5A44237800881DC439814C1C |
| SHA-512: | 23BFEB927C1385C28198E97EE4A54C898CD77349BBF93F3AF43223F2EE2B4C162E65C5648EEF3CC1FB456D5029ED4B52CE7C1AA14F3B92C4E60B5FDC42F6537C |
| Malicious: | false |
| URL: | https://ukrnic.com/user/classes/js/jqueryui.js?v=0d74b |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3653 |
| Entropy (8bit): | 5.206042262538661 |
| Encrypted: | false |
| SSDEEP: | 96:CD0nc0Wu7WncMvOTOhs25CKbadAkRaVUvxV:q0nc0t7WncMvOam2lbadAkRaVUvxV |
| MD5: | 60DD4A0324B6A778A81131C4DC6B2998 |
| SHA1: | A723D940F991F781044A948E4F423331646BF70A |
| SHA-256: | 266A3771EF39C4855333A8FF90D4A48D8C19F2DDB561CEB41A5A8AB4747304F8 |
| SHA-512: | FB313685DF29C20B324C3A0A8CA3096664DC4ED2AB7283C515FAF4C03D5371BB49757D553C2868378F5EB3903E36EE61BBCB2A0A10533242E5E764DCC13CA5C6 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 38999 |
| Entropy (8bit): | 5.3023564522926945 |
| Encrypted: | false |
| SSDEEP: | 768:VjpnX6gCsHxXed31au/mZD4bX5jVpcUSNLRvA1lZF:VjpfxXed31au/GDGVpc/NLRvA1lz |
| MD5: | 604E99214C677DCBBF0A5733A573E994 |
| SHA1: | 365CE769F328EC16EE405E704623C31386379163 |
| SHA-256: | 97618DAC21AA7D54B7CEDBBFAE803A9EFCA58FA176D51C36FE0F96B712DCFF6A |
| SHA-512: | FC2EE49010C8D169A76360DF1FBB3BE63FF3B2163236A005E6F1448FE2900A369681380BA263AA16C1DB5E338E5F4790D0B8103698846D4C9326ED0F3C0DED02 |
| Malicious: | false |
| URL: | https://ukrnic.com/user/classes/js/dle_js.js?v=0d74b |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 17693 |
| Entropy (8bit): | 5.193601462236965 |
| Encrypted: | false |
| SSDEEP: | 192:DRu/rqVKqnwVaWRRhGNV600A87QmxMQ5YcS:X8pVFThGfIA8smxMQ5YcS |
| MD5: | B355DB4FFE28B22FD0F0834172789766 |
| SHA1: | E934EF7056CEB7C39344BCA74A244F29C0F2F211 |
| SHA-256: | 203136393471237E11BB3EE3FD92EDC2CF983960D3C336F860914BB426FF0FAC |
| SHA-512: | 98D35C0E46D2ADD43235D50A1A90809B77E43149B2D4D5E9DF0B11CD8C4684A4EA66CEA6BF679D362207975CE6666B6A610475D62AD951DC5C6FA6F03403079D |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/css/style.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1226 |
| Entropy (8bit): | 6.182953729187001 |
| Encrypted: | false |
| SSDEEP: | 24:7K1hpunQWwjx82lY2T32HEVZsVo8ZiyJ3VZkDw218GBAn2MM:sitNn2Vzsi8rJ3PuFa14 |
| MD5: | 06DD9EF3C5E01A9913FDD7C7F3F6917B |
| SHA1: | A122919C97777BA05405580DECC9CFA614347AC7 |
| SHA-256: | EED9A76600A11346EF9F955DD19FC5F69888784E03A39D5B7DA0BFBD9CD72384 |
| SHA-512: | B738DE47BEDD46ED0DA040D1F04CEFF131EC9C1D40C8AC82F85344548FB415A93568EFAE4DB2C59316B62AB94EEE8D2B411028E365FFB44997E28933E746E9FB |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 38999 |
| Entropy (8bit): | 5.3023564522926945 |
| Encrypted: | false |
| SSDEEP: | 768:VjpnX6gCsHxXed31au/mZD4bX5jVpcUSNLRvA1lZF:VjpfxXed31au/GDGVpc/NLRvA1lz |
| MD5: | 604E99214C677DCBBF0A5733A573E994 |
| SHA1: | 365CE769F328EC16EE405E704623C31386379163 |
| SHA-256: | 97618DAC21AA7D54B7CEDBBFAE803A9EFCA58FA176D51C36FE0F96B712DCFF6A |
| SHA-512: | FC2EE49010C8D169A76360DF1FBB3BE63FF3B2163236A005E6F1448FE2900A369681380BA263AA16C1DB5E338E5F4790D0B8103698846D4C9326ED0F3C0DED02 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 834 |
| Entropy (8bit): | 7.644263095582123 |
| Encrypted: | false |
| SSDEEP: | 24:HFLYpGNcQApnHu6hL4gdCU4tilUF1sShFgE:lLYwpgOsCUgilUsSl |
| MD5: | 7CE87098ECD36FFBA933108D93A1801F |
| SHA1: | E07AD8D7310ECCB82AB6391E8A4E7D11EF11A27F |
| SHA-256: | 7B7090DE94AB13E86191FA2CBC3A259A7605129801A1F65B8E9F1DE6885606DC |
| SHA-512: | 91647390C8A95E28516EAAFE0B0D9D47A1A919D98D385FFF2DAC9FE4A343AF6D5DB508792D9185BA708C1ED4B984C2456D7AD349F00CAFCAC02134B309F0575C |
| Malicious: | false |
| URL: | https://get.mycounter.ua/counter.php?id=122274&w=https%3A//ukrnic.com/%7Efreexp/index.php&s=1280x1024x24&c=1&j=5&gmt=-5&dst=1 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1226 |
| Entropy (8bit): | 6.182953729187001 |
| Encrypted: | false |
| SSDEEP: | 24:7K1hpunQWwjx82lY2T32HEVZsVo8ZiyJ3VZkDw218GBAn2MM:sitNn2Vzsi8rJ3PuFa14 |
| MD5: | 06DD9EF3C5E01A9913FDD7C7F3F6917B |
| SHA1: | A122919C97777BA05405580DECC9CFA614347AC7 |
| SHA-256: | EED9A76600A11346EF9F955DD19FC5F69888784E03A39D5B7DA0BFBD9CD72384 |
| SHA-512: | B738DE47BEDD46ED0DA040D1F04CEFF131EC9C1D40C8AC82F85344548FB415A93568EFAE4DB2C59316B62AB94EEE8D2B411028E365FFB44997E28933E746E9FB |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/images/head_bg.jpg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2431 |
| Entropy (8bit): | 7.445085534154306 |
| Encrypted: | false |
| SSDEEP: | 48:sitNn2VaEDiJ389Q8GDPbqEft9MKpyynjRZR5QQgiOm4:l2YED59Q5bln171OL |
| MD5: | 89890396FE4591B2875F0B0164FE9C22 |
| SHA1: | 2CB1CACE0E6116FE382FE828D1743ADCF9E6FC68 |
| SHA-256: | 2DCFF68F03953EA23F23FC5E8C37504FF96264DAB832E2371FB01B0C616E6ABC |
| SHA-512: | 39156DE5474ED9C4F305AC98D41BBCE9E3851935F9FC4D867B5B37E8E46E8C695BC1B2F14BE2CD27879BD1CB9ADA5044E3F81D367EEB026E96E160410676C271 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22611 |
| Entropy (8bit): | 5.403021228493747 |
| Encrypted: | false |
| SSDEEP: | 384:Ea2j5UWULj9Po7/AT+GYkbN7xVBFdYKyy:Ea2j5UWUL5Po7lGYkbN7xVBFdYo |
| MD5: | 28D49B344FCDCA1634B83AF97C0FA2D9 |
| SHA1: | 007E910D61014D8FDEE05A349DDBBC207132ECC2 |
| SHA-256: | 8E25D9DF1B8574FF7AE925B3E9B043CE3A69BD0F0F83AD942E7F009D9D6ED347 |
| SHA-512: | 78313DD0A83AE4185C19BBAFEDEE7AA25DB5F80B9480A7406C4AAE65B3CC04324A7F78DEABE68A26149D558CA5457C60D1E3556A4CD85FD39079AC8DFAF2D978 |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/css/user.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3653 |
| Entropy (8bit): | 5.206042262538661 |
| Encrypted: | false |
| SSDEEP: | 96:CD0nc0Wu7WncMvOTOhs25CKbadAkRaVUvxV:q0nc0t7WncMvOam2lbadAkRaVUvxV |
| MD5: | 60DD4A0324B6A778A81131C4DC6B2998 |
| SHA1: | A723D940F991F781044A948E4F423331646BF70A |
| SHA-256: | 266A3771EF39C4855333A8FF90D4A48D8C19F2DDB561CEB41A5A8AB4747304F8 |
| SHA-512: | FB313685DF29C20B324C3A0A8CA3096664DC4ED2AB7283C515FAF4C03D5371BB49757D553C2868378F5EB3903E36EE61BBCB2A0A10533242E5E764DCC13CA5C6 |
| Malicious: | false |
| URL: | https://get.mycounter.ua/counter2.0.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1442 |
| Entropy (8bit): | 6.588806251073558 |
| Encrypted: | false |
| SSDEEP: | 24:7K1hpunQWwh82lYSgKG1EVrSNT3ZyJ3VZuewQG9k8TChF9dG8fpVnLHR0:sitvniNS0J3afQICj9dG8hhLHR0 |
| MD5: | EC137A302D20479F74AD5563B9420EA2 |
| SHA1: | 6DE30579E0D78D788BC0379EA0A4BF0D8EB3B7DE |
| SHA-256: | 34639447E85C4F2375F4D38B62639E5B6AACEBDCE4076884062A188E9D1F4D03 |
| SHA-512: | 9AC8446284B3B4DE24FA0130A38AD1507DB9FBF117442C2DD62BC4F770C17F4E16BD5C2E54E3691B8A20B04B9BF02C5D548FFC99512596FD90A1A4D1C3520213 |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/images/foot_r.jpg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 85578 |
| Entropy (8bit): | 5.366055229017455 |
| Encrypted: | false |
| SSDEEP: | 1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2 |
| MD5: | 2F6B11A7E914718E0290410E85366FE9 |
| SHA1: | 69BB69E25CA7D5EF0935317584E6153F3FD9A88C |
| SHA-256: | 05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E |
| SHA-512: | 0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB |
| Malicious: | false |
| URL: | https://ukrnic.com/user/classes/js/jquery.js?v=0d74b |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 894 |
| Entropy (8bit): | 1.855659497615512 |
| Encrypted: | false |
| SSDEEP: | 12:t46SNwX1SoXwI+3SowASoNSQ+G1SoXww1SoXASZa945PQqF:tKjqRxRTgZ/pQqF |
| MD5: | 38F74ECB47124291E75A405B86C867EE |
| SHA1: | E929FB7E3F9D9CBA8DADCE8063B35B8F076F1EAC |
| SHA-256: | 2B181664B62C94CCAE13EED7F2E9E8BD10921D295D452CCFB364E7F999553A03 |
| SHA-512: | FE6E6DE5164C7D59904F1B777DC9CE875FEC0514D843CBCA479FAA73252074790A53C87F748F138EB711D85E66634EA17E6D4E5FF993F990C828C27DFCD5728A |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 894 |
| Entropy (8bit): | 1.855659497615512 |
| Encrypted: | false |
| SSDEEP: | 12:t46SNwX1SoXwI+3SowASoNSQ+G1SoXww1SoXASZa945PQqF:tKjqRxRTgZ/pQqF |
| MD5: | 38F74ECB47124291E75A405B86C867EE |
| SHA1: | E929FB7E3F9D9CBA8DADCE8063B35B8F076F1EAC |
| SHA-256: | 2B181664B62C94CCAE13EED7F2E9E8BD10921D295D452CCFB364E7F999553A03 |
| SHA-512: | FE6E6DE5164C7D59904F1B777DC9CE875FEC0514D843CBCA479FAA73252074790A53C87F748F138EB711D85E66634EA17E6D4E5FF993F990C828C27DFCD5728A |
| Malicious: | false |
| URL: | https://ukrnic.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 85578 |
| Entropy (8bit): | 5.366055229017455 |
| Encrypted: | false |
| SSDEEP: | 1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2 |
| MD5: | 2F6B11A7E914718E0290410E85366FE9 |
| SHA1: | 69BB69E25CA7D5EF0935317584E6153F3FD9A88C |
| SHA-256: | 05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E |
| SHA-512: | 0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 8222 |
| Entropy (8bit): | 7.96775875318015 |
| Encrypted: | false |
| SSDEEP: | 192:wdoQY1WM2oEVMnMPUaPQLfoVFaDgSBLJE9sTN66ACj80i8O:wds1WXQ/LfovaDgSjE9P6ACj8B |
| MD5: | 30A439AAF904C3E77F9A0A72D6E7398D |
| SHA1: | 82695E64F0F73C1134EF77C262648C5F8E97929B |
| SHA-256: | 4B0413E203671CA15E3337FBF04859E64015CBE08A3C013D9432EAF607A72CFD |
| SHA-512: | 58C55B8C1217BBF3DF296F20664F7FA96E02ED34C19D4B9AC0DA03D7421D6628E6E9C3B0CA3304E717209C1CB7D2F999B5312482983354942D265CDDE6E79199 |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/images/liqpay6.png |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10642 |
| Entropy (8bit): | 7.954113254251009 |
| Encrypted: | false |
| SSDEEP: | 192:AEv+2QMpaz3/JNKNx5gNJp9rVxkFu0HSBJQCpKqheL+++9FKLI4:AE/ar/2NxqNHaFu0/4Uc4 |
| MD5: | D3880CB8F6376272AFD3AB13DD172E40 |
| SHA1: | A58A22971331D9FC4F7DE43AC512311DD4D41CC4 |
| SHA-256: | 501B6FDAE18E5CE15B2CBB19C39A988E9598B440677D65611DC7C1AEFD043DA2 |
| SHA-512: | 867213B690293D7DBC67AA693588753F168582FBC4F7A60ED4B23180E6A8868D17C57BFF8C8885A016A6053316066712DEF784B18F8B12E182BBC514698B1349 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1339 |
| Entropy (8bit): | 6.450737433708996 |
| Encrypted: | false |
| SSDEEP: | 24:7K1hpunQWwjx82lY2T32HEVrSKKcyJ3VZHK0UmlG+OhOLHyp6cPGCh:sitNn2VgJ3GEChOLyp6cP5 |
| MD5: | 0324663849AD24E87F11AC1D6516320F |
| SHA1: | 37CEAFDAC709E5818089BA53787C9B517C36A67C |
| SHA-256: | 20B89C628474D9E755331C942445AE271E7664855B4CF6F263D8B2105B124A57 |
| SHA-512: | EC696DC3FE375AC76ADCB89CB36B52B23DB092C24559A8130DB6F7CB218E90C081D25C12D581C66A4B247CF1FE313C42C39AD37D9DCB6A00170BF9C63E468F37 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8222 |
| Entropy (8bit): | 7.96775875318015 |
| Encrypted: | false |
| SSDEEP: | 192:wdoQY1WM2oEVMnMPUaPQLfoVFaDgSBLJE9sTN66ACj80i8O:wds1WXQ/LfovaDgSjE9P6ACj8B |
| MD5: | 30A439AAF904C3E77F9A0A72D6E7398D |
| SHA1: | 82695E64F0F73C1134EF77C262648C5F8E97929B |
| SHA-256: | 4B0413E203671CA15E3337FBF04859E64015CBE08A3C013D9432EAF607A72CFD |
| SHA-512: | 58C55B8C1217BBF3DF296F20664F7FA96E02ED34C19D4B9AC0DA03D7421D6628E6E9C3B0CA3304E717209C1CB7D2F999B5312482983354942D265CDDE6E79199 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2431 |
| Entropy (8bit): | 7.445085534154306 |
| Encrypted: | false |
| SSDEEP: | 48:sitNn2VaEDiJ389Q8GDPbqEft9MKpyynjRZR5QQgiOm4:l2YED59Q5bln171OL |
| MD5: | 89890396FE4591B2875F0B0164FE9C22 |
| SHA1: | 2CB1CACE0E6116FE382FE828D1743ADCF9E6FC68 |
| SHA-256: | 2DCFF68F03953EA23F23FC5E8C37504FF96264DAB832E2371FB01B0C616E6ABC |
| SHA-512: | 39156DE5474ED9C4F305AC98D41BBCE9E3851935F9FC4D867B5B37E8E46E8C695BC1B2F14BE2CD27879BD1CB9ADA5044E3F81D367EEB026E96E160410676C271 |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/images/head_r.jpg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 96190 |
| Entropy (8bit): | 5.204592287727612 |
| Encrypted: | false |
| SSDEEP: | 1536:m05y+RkV1zWQGPe2Yw3kub7wwxFLn0IR0HoKcu3RiiHf3ma8yAJYMye:S+jTi2u3EiHf3ma0Jrye |
| MD5: | 0595E298FE7D89DBA01F17568493A734 |
| SHA1: | B2099FDD5B5D744FBB5DE8B3F0618C522F4CE44D |
| SHA-256: | 54A82CB12E6E213C3B94FB1674617997E730F8FB5A44237800881DC439814C1C |
| SHA-512: | 23BFEB927C1385C28198E97EE4A54C898CD77349BBF93F3AF43223F2EE2B4C162E65C5648EEF3CC1FB456D5029ED4B52CE7C1AA14F3B92C4E60B5FDC42F6537C |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 10642 |
| Entropy (8bit): | 7.954113254251009 |
| Encrypted: | false |
| SSDEEP: | 192:AEv+2QMpaz3/JNKNx5gNJp9rVxkFu0HSBJQCpKqheL+++9FKLI4:AE/ar/2NxqNHaFu0/4Uc4 |
| MD5: | D3880CB8F6376272AFD3AB13DD172E40 |
| SHA1: | A58A22971331D9FC4F7DE43AC512311DD4D41CC4 |
| SHA-256: | 501B6FDAE18E5CE15B2CBB19C39A988E9598B440677D65611DC7C1AEFD043DA2 |
| SHA-512: | 867213B690293D7DBC67AA693588753F168582FBC4F7A60ED4B23180E6A8868D17C57BFF8C8885A016A6053316066712DEF784B18F8B12E182BBC514698B1349 |
| Malicious: | false |
| URL: | https://ukrnic.com/templates/ukrnic/images/logo.png |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1442 |
| Entropy (8bit): | 6.588806251073558 |
| Encrypted: | false |
| SSDEEP: | 24:7K1hpunQWwh82lYSgKG1EVrSNT3ZyJ3VZuewQG9k8TChF9dG8fpVnLHR0:sitvniNS0J3afQICj9dG8hhLHR0 |
| MD5: | EC137A302D20479F74AD5563B9420EA2 |
| SHA1: | 6DE30579E0D78D788BC0379EA0A4BF0D8EB3B7DE |
| SHA-256: | 34639447E85C4F2375F4D38B62639E5B6AACEBDCE4076884062A188E9D1F4D03 |
| SHA-512: | 9AC8446284B3B4DE24FA0130A38AD1507DB9FBF117442C2DD62BC4F770C17F4E16BD5C2E54E3691B8A20B04B9BF02C5D548FFC99512596FD90A1A4D1C3520213 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 834 |
| Entropy (8bit): | 7.644263095582123 |
| Encrypted: | false |
| SSDEEP: | 24:HFLYpGNcQApnHu6hL4gdCU4tilUF1sShFgE:lLYwpgOsCUgilUsSl |
| MD5: | 7CE87098ECD36FFBA933108D93A1801F |
| SHA1: | E07AD8D7310ECCB82AB6391E8A4E7D11EF11A27F |
| SHA-256: | 7B7090DE94AB13E86191FA2CBC3A259A7605129801A1F65B8E9F1DE6885606DC |
| SHA-512: | 91647390C8A95E28516EAAFE0B0D9D47A1A919D98D385FFF2DAC9FE4A343AF6D5DB508792D9185BA708C1ED4B984C2456D7AD349F00CAFCAC02134B309F0575C |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.909145739050385 |
| TrID: |
|
| File name: | izCOFC8OWh.exe |
| File size: | 88'557 bytes |
| MD5: | d7326ecb2bda34ba1dc81c821e6f32af |
| SHA1: | 59362f6d162758adf219397bcc11c80ad0ca8fc3 |
| SHA256: | 8513d85822ec820592542026eca0fd8b71cacf15e2d9d3c8a6d564c7899dcf90 |
| SHA512: | a890f077adc904be818f9a17148ee8abb2258654824d27e21d84e5e7862087639881642afe094bfd3d1968d4786f8d24035d72ed785173fc3c91bad9438b0e7d |
| SSDEEP: | 1536:NJVxqmQSMvEhyEwhND3ugqqM/D2XkQ5XRBMtxjMSmX:NzftMvLdnD3ZFK2XL57MtxNu |
| TLSH: | 48837D13F6D0C836E0605EF88C299584AA6B7A722D3A44567BED0F0F9E68393CC5D247 |
| File Content Preview: | MZP.....................@...............................................!..L.!..This program must be run under Win32..$7....................................................................................................................................... |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x40d3f8 |
| Entrypoint Section: | CODE |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
| DLL Characteristics: | |
| Time Stamp: | 0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 568f857a51133658be49d01e79865581 |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| mov ecx, 00000007h |
| push 00000000h |
| push 00000000h |
| dec ecx |
| jne 00007F2320BA4F6Bh |
| push ebx |
| push esi |
| push edi |
| mov eax, 0040D3A8h |
| call 00007F2320B9D3F5h |
| xor eax, eax |
| push ebp |
| push 0040D665h |
| push dword ptr fs:[eax] |
| mov dword ptr fs:[eax], esp |
| call 00007F2320BA32A2h |
| call 00007F2320BA35A9h |
| sub eax, 01h |
| jc 00007F2320BA4F84h |
| je 00007F2320BA5038h |
| dec eax |
| je 00007F2320BA504Dh |
| jmp 00007F2320BA517Ch |
| push 00000000h |
| lea eax, dword ptr [ebp-14h] |
| mov ecx, dword ptr [0040F7F0h] |
| mov edx, dword ptr [0040F7E4h] |
| call 00007F2320B9BFF0h |
| mov eax, dword ptr [ebp-14h] |
| call 00007F2320B9C19Ch |
| push eax |
| mov eax, dword ptr [0040F7FCh] |
| call 00007F2320B9C191h |
| push eax |
| call 00007F2320B9D453h |
| test eax, eax |
| je 00007F2320BA4FD6h |
| xor eax, eax |
| push ebp |
| push 0040D4AAh |
| push dword ptr fs:[eax] |
| mov dword ptr fs:[eax], esp |
| lea eax, dword ptr [ebp-18h] |
| mov ecx, dword ptr [0040F7F0h] |
| mov edx, dword ptr [0040F7E4h] |
| call 00007F2320B9BFB1h |
| mov eax, dword ptr [ebp-18h] |
| call 00007F2320BA2199h |
| xor eax, eax |
| pop edx |
| pop ecx |
| pop ecx |
| mov dword ptr fs:[eax], edx |
| jmp 00007F2320BA4F7Ch |
| jmp 00007F2320B9B5CAh |
| call 00007F2320B9B7A5h |
| push 00000000h |
| lea eax, dword ptr [ebp-1Ch] |
| mov ecx, dword ptr [0040F7F0h] |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x10000 | 0xa0 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x14000 | 0x1400 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x16f3c | 0x18 | .aspack |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x100000 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| CODE | 0x1000 | 0xd000 | 0xd000 | 1d7e639754f0d4dd0d758814c07c7c30 | False | 0.5449030949519231 | data | 6.341398593785762 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| DATA | 0xe000 | 0x1000 | 0x1000 | ba5742996b253f5b40172a689f0baa04 | False | 0.169189453125 | data | 1.8756338810122581 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| BSS | 0xf000 | 0x1000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0x10000 | 0x1000 | 0x1000 | c82cdd516fea9052cede1512d37379f8 | False | 0.237060546875 | data | 3.1322699702118446 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x11000 | 0x1000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0x12000 | 0x1000 | 0x200 | 214a209aa2c527f89ad12222527bb103 | False | 0.05078125 | MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "A" | 0.20544562813451883 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .reloc | 0x13000 | 0x1000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x14000 | 0x2000 | 0x2000 | dabccab5482c1b2c842f00e943a8d5a6 | False | 0.149658203125 | data | 1.7343004441507188 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .aspack | 0x16000 | 0x2000 | 0x1800 | bb4520d55af20f7751916638ee7c5b26 | False | 0.5608723958333334 | data | 5.735754218820344 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .adata | 0x18000 | 0x1000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_STRING | 0x14248 | 0xf0 | data | 0.4666666666666667 | ||
| RT_STRING | 0x14338 | 0xd8 | data | 0.5740740740740741 | ||
| RT_STRING | 0x14410 | 0x260 | data | 0.4457236842105263 | ||
| RT_STRING | 0x14670 | 0x37c | data | 0.4080717488789238 | ||
| RT_STRING | 0x149ec | 0x2a0 | data | 0.4017857142857143 | ||
| RT_RCDATA | 0x14c8c | 0x10 | data | 1.5 | ||
| RT_RCDATA | 0x14c9c | 0x6c | data | 0.9907407407407407 | ||
| RT_VERSION | 0x173a4 | 0x2b8 | COM executable for DOS | Romanian | Romania | 0.46551724137931033 |
| RT_MANIFEST | 0x170b8 | 0x2e9 | XML 1.0 document, ASCII text, with CRLF line terminators | 0.487248322147651 |
| DLL | Import |
|---|---|
| kernel32.dll | DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, WideCharToMultiByte, SetCurrentDirectoryA, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle |
| user32.dll | GetKeyboardType, LoadStringA, MessageBoxA, CharNextA |
| advapi32.dll | RegQueryValueExA, RegOpenKeyExA, RegCloseKey |
| oleaut32.dll | SysFreeString, SysReAllocStringLen, SysAllocStringLen |
| kernel32.dll | TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA |
| kernel32.dll | WriteFile, WinExec, VirtualQuery, Sleep, SetCurrentDirectoryA, MoveFileA, LoadLibraryA, GetVersionExA, GetThreadLocale, GetStringTypeExA, GetStdHandle, GetShortPathNameA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetFileAttributesA, GetEnvironmentVariableA, GetDiskFreeSpaceA, GetCPInfo, GetACP, FreeLibrary, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, DeleteFileA, CreateDirectoryA, CopyFileA, CloseHandle |
| user32.dll | MessageBoxA, LoadStringA, GetSystemMetrics, CharNextA, CharToOemA |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Romanian | Romania |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 5, 2024 18:04:22.175302982 CET | 49799 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:22.175934076 CET | 49800 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:22.295141935 CET | 80 | 49799 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:22.295629025 CET | 80 | 49800 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:22.295672894 CET | 49799 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:22.295708895 CET | 49800 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:22.496561050 CET | 49801 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:22.497189045 CET | 49800 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:22.616594076 CET | 80 | 49801 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:22.616811037 CET | 49801 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:22.616996050 CET | 80 | 49800 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:23.711318970 CET | 80 | 49800 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:23.856945992 CET | 49800 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:23.865045071 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:23.865071058 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:23.865222931 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:23.865417004 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:23.865432024 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:23.953100920 CET | 80 | 49800 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:24.046948910 CET | 49800 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:25.752525091 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.776819944 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:25.776849985 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.778083086 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.778203964 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:25.785067081 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:25.785197020 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.785279989 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:25.785289049 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.922030926 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:25.965919018 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:25.965975046 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.966047049 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:25.966264963 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:25.966280937 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.343247890 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.343280077 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.343291998 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.343391895 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.343422890 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.343508005 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.349966049 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.350080013 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.350126028 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.350604057 CET | 49808 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.350626945 CET | 443 | 49808 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.405369997 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.405426979 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.405499935 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.405881882 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.405920029 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.406086922 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.406399965 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.406423092 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.406646013 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.406761885 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.406795979 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.406850100 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.407150030 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.407169104 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.407320023 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.407341003 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.407413960 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.407428026 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:26.407541990 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:26.407561064 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.798296928 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.845330000 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:27.845376968 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.846573114 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.846636057 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:27.852626085 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.852797985 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.852797031 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.855720043 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.858905077 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.858916044 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.859098911 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.859106064 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.859329939 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.859335899 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.859496117 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:27.859621048 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.859690905 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.859961033 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.860013008 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.860083103 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.860094070 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.860207081 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.860264063 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.860411882 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.860440969 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.860466003 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.861198902 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.861248970 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.861624002 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.861675978 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.862438917 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.862502098 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.862741947 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.862831116 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.862837076 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.862880945 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.862885952 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.863028049 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.903325081 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.903325081 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.951858997 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:27.951884985 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:27.951919079 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:27.951920986 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.156636000 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:28.445900917 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.445930958 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.445940018 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.445969105 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.446043015 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.446043968 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.446060896 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.447457075 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.447482109 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.447540045 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.447547913 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.450810909 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.450880051 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.450901985 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.450923920 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.450936079 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.450947046 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.450978994 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.455288887 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.455363035 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.455430984 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.455441952 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.540296078 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.558489084 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.558491945 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.558491945 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.558511019 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.635669947 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.635695934 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.635721922 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.635737896 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.635750055 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.635793924 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.636233091 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.636248112 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.636270046 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.636302948 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.636349916 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.636915922 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.636929989 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.636955023 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.636986971 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.637011051 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.640364885 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.640441895 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.640448093 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.640491962 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.641422987 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.641453028 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.641489029 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.641490936 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.641526937 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.641552925 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.656464100 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.656485081 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.656517029 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.656673908 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.656673908 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.656706095 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.656727076 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.656781912 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.662439108 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.662466049 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.662580967 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.664870024 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.664882898 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.664926052 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.664985895 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.665011883 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.676820040 CET | 49817 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.676853895 CET | 443 | 49817 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.677223921 CET | 49820 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.677237988 CET | 443 | 49820 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.690053940 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.690064907 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.690098047 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.690146923 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.690208912 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.692054033 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.692106962 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.692487001 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.692527056 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.692531109 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.692826986 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.692843914 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.692862034 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.693447113 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.693464994 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.695271015 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.695287943 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.695362091 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.715420008 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.715435028 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.715487003 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.715583086 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.715745926 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.723098040 CET | 80 | 49800 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.723205090 CET | 49800 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.743515968 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.743530035 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.743609905 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.836611986 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.836630106 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.836776018 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.849134922 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.849226952 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.851322889 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.851331949 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.851399899 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.870168924 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.870181084 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.870243073 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.873550892 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.873625994 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.884680986 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.884691954 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.884762049 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.891796112 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.891887903 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.899204969 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.899285078 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.907968044 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.908085108 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.913100958 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.913194895 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.913203955 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.913249016 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.913769007 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.913796902 CET | 443 | 49819 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.913808107 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.913845062 CET | 49819 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.918956995 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.919047117 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.946526051 CET | 49800 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.947073936 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.947143078 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.947247028 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.948069096 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.948101044 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.948252916 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.950618982 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.950659037 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.950797081 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.951154947 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.951181889 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.951745033 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.951765060 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.952074051 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:28.952095032 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.952449083 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.952547073 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.029865026 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.029989958 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.030051947 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.030051947 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.043766975 CET | 49818 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.043786049 CET | 443 | 49818 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.044444084 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.044491053 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.044648886 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.046782017 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.046798944 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.066864967 CET | 80 | 49800 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.130575895 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.130630016 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.130790949 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.130979061 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.131051064 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.131172895 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.131442070 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.131458998 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.131616116 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:29.131628036 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.709364891 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:29.709444046 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.709523916 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:29.709743977 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:29.709755898 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.133089066 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.136248112 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.142797947 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.142819881 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.143028975 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.143049955 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.143379927 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.143511057 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.143943071 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.144022942 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.144211054 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.144469023 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.144565105 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.144635916 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.187341928 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.191328049 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.401201963 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.405055046 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.405302048 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.495218039 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.495253086 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.495512009 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.495522976 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.496469021 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.496485949 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.496536016 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.496686935 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.496706009 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.496771097 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.497539043 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.497608900 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.497864962 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.497879028 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.498172998 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.498238087 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.498282909 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.498291016 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.498363018 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.498369932 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.499012947 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.499030113 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.499070883 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.504091978 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.505834103 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.505930901 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.506324053 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.506331921 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.506967068 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.506973028 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.516318083 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.516390085 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.517353058 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.518173933 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.518179893 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.519447088 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.556113005 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.560142994 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.560195923 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.590747118 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.590989113 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.591007948 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.591259003 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.591953993 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.591984987 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.592314005 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.592367887 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.592713118 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.592873096 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.593311071 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.593365908 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.593379974 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.593815088 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.593883038 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.594022989 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.594031096 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.717257023 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.717284918 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.717318058 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.717334032 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.721748114 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.721776009 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.721847057 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.721877098 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.722382069 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.722438097 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.722445011 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.722470999 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.722517014 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.727840900 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.727936029 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.727992058 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.749191046 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.754625082 CET | 49828 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.754662991 CET | 443 | 49828 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.756984949 CET | 49829 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.757023096 CET | 443 | 49829 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.762041092 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.762077093 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.762243986 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.763207912 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.763221979 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.771805048 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.771851063 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.771920919 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.772094011 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.772108078 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:30.919694901 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:30.919780016 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.000844955 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.000931025 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.001013994 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.003870964 CET | 49832 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.003887892 CET | 443 | 49832 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.009953022 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.009994030 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.010138988 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.010351896 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.010365963 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.035059929 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.035082102 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.035134077 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.035139084 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.035187006 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.036286116 CET | 49831 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.036303997 CET | 443 | 49831 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.039041996 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.039100885 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.039263964 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.039463997 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.039484024 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.040884972 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.040900946 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.041003942 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.041161060 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.041171074 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.074817896 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.074846983 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.074853897 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.074898005 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.074928999 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.074958086 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.074973106 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.074974060 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.075015068 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.096390963 CET | 49833 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.096429110 CET | 443 | 49833 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.110441923 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.110472918 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.110488892 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.110496044 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.110544920 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.110563993 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.185815096 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.185846090 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.185853004 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.185872078 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.185903072 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.185929060 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.185942888 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.188651085 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.188674927 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.188682079 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.188707113 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.188739061 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.188761950 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.188787937 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.220558882 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.251079082 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.300333977 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.300349951 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.300395966 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.300415039 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.300448895 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.329602957 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.329616070 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.329642057 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.329672098 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.329715014 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.354913950 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.354928017 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.354958057 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.355005980 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.355042934 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.375879049 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.375895023 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.375933886 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.375948906 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.375962019 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.376000881 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.377644062 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.377654076 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.377702951 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.377707005 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.377749920 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.380500078 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.380516052 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.380537033 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.380583048 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.380633116 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.380682945 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.380881071 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.380901098 CET | 443 | 49835 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.380917072 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.380953074 CET | 49835 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.400690079 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.400706053 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.400726080 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.400767088 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.400814056 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.400995970 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.401005030 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.401032925 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.401051044 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.401079893 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.434417963 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.434429884 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.434452057 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.434494019 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.434570074 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.435035944 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.435044050 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.435079098 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.435110092 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.435132980 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.458230019 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.458239079 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.458270073 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.458286047 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.458339930 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.460390091 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.460398912 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.460470915 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.574527979 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.574837923 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:31.574866056 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.575877905 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.575887918 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.575910091 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.575936079 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.576088905 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.576121092 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.576143026 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:31.578429937 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:31.578491926 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.578752041 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:31.578758955 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.585575104 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.585583925 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.585654020 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.591866970 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.591878891 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.591898918 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.591945887 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.591980934 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.603977919 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.603986979 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.604048967 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.609535933 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.609545946 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.609574080 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.609592915 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.609643936 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.617767096 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.617777109 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.617837906 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.622767925 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:31.623780966 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.623789072 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.623858929 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.634413958 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.634423018 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.634506941 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.637814045 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.637820959 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.637914896 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.645109892 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.645196915 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.651710987 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.651777029 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.651784897 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.651865959 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.655800104 CET | 49836 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.655817032 CET | 443 | 49836 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.656151056 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.656205893 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.656533957 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.656625986 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.656631947 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.657138109 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.657155037 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.761523962 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.761594057 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.761621952 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.761663914 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.761709929 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.768953085 CET | 49837 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.768973112 CET | 443 | 49837 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.769330025 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.769378901 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:31.769454956 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.770558119 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:31.770570040 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.000060081 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.000082970 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.000138998 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.000144958 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.000252962 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.001491070 CET | 49839 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.001502991 CET | 443 | 49839 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.014612913 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.014648914 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.014723063 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.015033007 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.015048027 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.208997965 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.209407091 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.209431887 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.209745884 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.210144997 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.210201979 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.210328102 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.210840940 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.211646080 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.211661100 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.212044001 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.212306023 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.212383986 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.212414026 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.244659901 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.244698048 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.245261908 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.245471001 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:32.245484114 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.255330086 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.255331993 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.358724117 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.415339947 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.415477991 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.446110010 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.473011017 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.473061085 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.474191904 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.474253893 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.483483076 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.483486891 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.496562004 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.496681929 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.529649019 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.529680967 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.530350924 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.530375957 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.530752897 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.530772924 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.530811071 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.530949116 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.531013012 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.531390905 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.531464100 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.532080889 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.532145977 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.532332897 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.532479048 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.532485008 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.579334974 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.739337921 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.739408016 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.743335009 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.743396044 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.830050945 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.830128908 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.831619978 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.835253000 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.835280895 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.835294008 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.835320950 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.835339069 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.835351944 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.835365057 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.841483116 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.841547966 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.841556072 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.841728926 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.874207973 CET | 49846 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.874242067 CET | 443 | 49846 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.876305103 CET | 49845 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:32.876324892 CET | 443 | 49845 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.032315016 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.032396078 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.032516003 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.067689896 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.067718983 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.067779064 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.067840099 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.067878962 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.071572065 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.071593046 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.071634054 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.071647882 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.071686983 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.107239008 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.150559902 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.150578976 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.152115107 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.152169943 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.156671047 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.156790018 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.159318924 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.159327030 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.163285971 CET | 49848 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.163333893 CET | 443 | 49848 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.165868044 CET | 49849 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.165887117 CET | 443 | 49849 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.166656971 CET | 49850 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.166670084 CET | 443 | 49850 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.216643095 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.217422009 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.217462063 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.218544006 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.218609095 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.219495058 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.219572067 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.219746113 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.219754934 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.256481886 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.282408953 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.282469988 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.282536983 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.282773018 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.282788038 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.356650114 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.437104940 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.438324928 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.438334942 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.438704967 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.439166069 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.439224958 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.439322948 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.487334013 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.684221029 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.684624910 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.684649944 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.685714006 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.685782909 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.686141014 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.686198950 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.686310053 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.686319113 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.699503899 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.699533939 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.699542046 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.699567080 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.699599028 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.699626923 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.699636936 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.699655056 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.699703932 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.702188015 CET | 49851 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.702204943 CET | 443 | 49851 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.767699003 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:33.807655096 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.807687998 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.807696104 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.807729006 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.807749987 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.807789087 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:33.807801962 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:33.873507023 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.000963926 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.000982046 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.001020908 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.001063108 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.001099110 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.030668974 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.030684948 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.030710936 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.030765057 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.030810118 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.055402040 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.055418968 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.055455923 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.055461884 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.055520058 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.069453955 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.069540977 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.073518038 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.076350927 CET | 49855 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.076365948 CET | 443 | 49855 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.080491066 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.080504894 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.080569029 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.080590963 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.080636024 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.084031105 CET | 49852 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.084052086 CET | 443 | 49852 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.160473108 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.160516977 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.160705090 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.161119938 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.161134005 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.309362888 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.309391022 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.309449911 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.309456110 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.310137987 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.332012892 CET | 49860 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.332032919 CET | 443 | 49860 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.335350990 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.335407019 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.335475922 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.335769892 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:34.335784912 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.728508949 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.728775978 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.728789091 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.729155064 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.729742050 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.729805946 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:34.729957104 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:34.771336079 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.321046114 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.321070910 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.321132898 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:35.321135998 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.321237087 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:35.415255070 CET | 49865 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:35.415281057 CET | 443 | 49865 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.602195024 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.722898960 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:35.734853029 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:35.734879017 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.735461950 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.738497019 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:35.738595963 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.738991022 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:35.767326117 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.768104076 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:35.768132925 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.768523932 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.768841028 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:35.768908024 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.768986940 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:35.779339075 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:35.811343908 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.188291073 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.188378096 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.188488007 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:36.193761110 CET | 49866 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:36.193790913 CET | 443 | 49866 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.200454950 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:36.200495005 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.200745106 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:36.200970888 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:36.200987101 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.398823977 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.398910999 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:36.399058104 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:36.403795004 CET | 49868 | 443 | 192.168.2.6 | 62.149.0.249 |
| Dec 5, 2024 18:04:36.403834105 CET | 443 | 49868 | 62.149.0.249 | 192.168.2.6 |
| Dec 5, 2024 18:04:37.357170105 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:37.357378960 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:04:37.357455969 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:37.647075891 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:37.647350073 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:37.647371054 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:37.647732019 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:37.648178101 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:37.648250103 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:37.648519993 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:37.691333055 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:38.238518953 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:38.238607883 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:38.238704920 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:38.367460966 CET | 49873 | 443 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:04:38.367486954 CET | 443 | 49873 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:04:38.460755110 CET | 49816 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:04:38.460777998 CET | 443 | 49816 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:07.356678009 CET | 49799 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:05:07.480532885 CET | 80 | 49799 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:05:07.626452923 CET | 49801 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:05:07.746437073 CET | 80 | 49801 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:05:23.122869015 CET | 49799 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:05:23.122914076 CET | 49801 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:05:23.243010998 CET | 80 | 49799 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:05:23.243072987 CET | 49799 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:05:23.243927956 CET | 80 | 49801 | 91.197.17.8 | 192.168.2.6 |
| Dec 5, 2024 18:05:23.243984938 CET | 49801 | 80 | 192.168.2.6 | 91.197.17.8 |
| Dec 5, 2024 18:05:25.827935934 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:25.827971935 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:25.828031063 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:25.828253984 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:25.828265905 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:27.562483072 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:27.562798023 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:27.562820911 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:27.563163042 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:27.563457012 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:27.563514948 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:27.606724024 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:37.256639957 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:37.256707907 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Dec 5, 2024 18:05:37.261903048 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:38.031533003 CET | 49992 | 443 | 192.168.2.6 | 142.250.181.68 |
| Dec 5, 2024 18:05:38.031568050 CET | 443 | 49992 | 142.250.181.68 | 192.168.2.6 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 5, 2024 18:03:42.248627901 CET | 60828 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:03:42.489622116 CET | 53 | 60828 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:03:42.522116899 CET | 51255 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:03:43.143528938 CET | 53 | 51255 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:03:43.465696096 CET | 61421 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:03:43.891447067 CET | 53 | 61421 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:21.352426052 CET | 62803 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:21.352591038 CET | 63881 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:21.488509893 CET | 53 | 64283 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:21.510371923 CET | 53 | 60893 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:21.809674978 CET | 53 | 62803 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:21.849172115 CET | 53 | 63881 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:23.721187115 CET | 62145 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:23.721410990 CET | 55229 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:23.863428116 CET | 53 | 62145 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:23.864353895 CET | 53 | 55229 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:24.473371983 CET | 53 | 64311 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.778188944 CET | 59880 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:25.778430939 CET | 49984 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:25.917608023 CET | 53 | 59880 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:25.917643070 CET | 53 | 49984 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:28.947489023 CET | 53671 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:28.947623968 CET | 62558 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:28.987031937 CET | 55556 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:28.987490892 CET | 60524 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:29.126121044 CET | 53 | 55556 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.128699064 CET | 53 | 60524 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.708163977 CET | 53 | 53671 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:29.708893061 CET | 53 | 62558 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.100162029 CET | 63291 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:32.100382090 CET | 63978 | 53 | 192.168.2.6 | 1.1.1.1 |
| Dec 5, 2024 18:04:32.241941929 CET | 53 | 63291 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:32.244235992 CET | 53 | 63978 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:04:41.452827930 CET | 53 | 58892 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:05:00.467749119 CET | 53 | 64363 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:05:21.341557026 CET | 53 | 57841 | 1.1.1.1 | 192.168.2.6 |
| Dec 5, 2024 18:05:23.261867046 CET | 53 | 61553 | 1.1.1.1 | 192.168.2.6 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 5, 2024 18:03:42.248627901 CET | 192.168.2.6 | 1.1.1.1 | 0x898a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:03:42.522116899 CET | 192.168.2.6 | 1.1.1.1 | 0xfe7d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:03:43.465696096 CET | 192.168.2.6 | 1.1.1.1 | 0x8b34 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:21.352426052 CET | 192.168.2.6 | 1.1.1.1 | 0x9e2b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:21.352591038 CET | 192.168.2.6 | 1.1.1.1 | 0x1301 | Standard query (0) | 65 | IN (0x0001) | false | |
| Dec 5, 2024 18:04:23.721187115 CET | 192.168.2.6 | 1.1.1.1 | 0x4bb7 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:23.721410990 CET | 192.168.2.6 | 1.1.1.1 | 0x3b04 | Standard query (0) | 65 | IN (0x0001) | false | |
| Dec 5, 2024 18:04:25.778188944 CET | 192.168.2.6 | 1.1.1.1 | 0xa63d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:25.778430939 CET | 192.168.2.6 | 1.1.1.1 | 0xc2b3 | Standard query (0) | 65 | IN (0x0001) | false | |
| Dec 5, 2024 18:04:28.947489023 CET | 192.168.2.6 | 1.1.1.1 | 0x6f52 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:28.947623968 CET | 192.168.2.6 | 1.1.1.1 | 0xc23a | Standard query (0) | 65 | IN (0x0001) | false | |
| Dec 5, 2024 18:04:28.987031937 CET | 192.168.2.6 | 1.1.1.1 | 0x9a9c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:28.987490892 CET | 192.168.2.6 | 1.1.1.1 | 0x55de | Standard query (0) | 65 | IN (0x0001) | false | |
| Dec 5, 2024 18:04:32.100162029 CET | 192.168.2.6 | 1.1.1.1 | 0x58ee | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:32.100382090 CET | 192.168.2.6 | 1.1.1.1 | 0xaf34 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 5, 2024 18:03:39.385724068 CET | 1.1.1.1 | 192.168.2.6 | 0x4874 | No error (0) | fp2e7a.wpc.phicdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 5, 2024 18:03:39.385724068 CET | 1.1.1.1 | 192.168.2.6 | 0x4874 | No error (0) | 192.229.221.95 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:03:42.489622116 CET | 1.1.1.1 | 192.168.2.6 | 0x898a | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:03:43.143528938 CET | 1.1.1.1 | 192.168.2.6 | 0xfe7d | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:03:43.891447067 CET | 1.1.1.1 | 192.168.2.6 | 0x8b34 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Dec 5, 2024 18:04:21.809674978 CET | 1.1.1.1 | 192.168.2.6 | 0x9e2b | No error (0) | 91.197.17.8 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:23.863428116 CET | 1.1.1.1 | 192.168.2.6 | 0x4bb7 | No error (0) | 91.197.17.8 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:25.917608023 CET | 1.1.1.1 | 192.168.2.6 | 0xa63d | No error (0) | 142.250.181.68 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:25.917643070 CET | 1.1.1.1 | 192.168.2.6 | 0xc2b3 | No error (0) | 65 | IN (0x0001) | false | |||
| Dec 5, 2024 18:04:27.208051920 CET | 1.1.1.1 | 192.168.2.6 | 0x3ca2 | No error (0) | ax-0001.ax-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:27.208051920 CET | 1.1.1.1 | 192.168.2.6 | 0x3ca2 | No error (0) | 150.171.28.10 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:27.208051920 CET | 1.1.1.1 | 192.168.2.6 | 0x3ca2 | No error (0) | 150.171.27.10 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:29.126121044 CET | 1.1.1.1 | 192.168.2.6 | 0x9a9c | No error (0) | 91.197.17.8 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:29.708163977 CET | 1.1.1.1 | 192.168.2.6 | 0x6f52 | No error (0) | 62.149.0.249 | A (IP address) | IN (0x0001) | false | ||
| Dec 5, 2024 18:04:32.241941929 CET | 1.1.1.1 | 192.168.2.6 | 0x58ee | No error (0) | 62.149.0.249 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.6 | 49800 | 91.197.17.8 | 80 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 5, 2024 18:04:22.497189045 CET | 442 | OUT | |
| Dec 5, 2024 18:04:23.711318970 CET | 533 | IN | |
| Dec 5, 2024 18:04:23.953100920 CET | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.6 | 49799 | 91.197.17.8 | 80 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 5, 2024 18:05:07.356678009 CET | 6 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.6 | 49801 | 91.197.17.8 | 80 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 5, 2024 18:05:07.626452923 CET | 6 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.6 | 49808 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:25 UTC | 670 | OUT | |
| 2024-12-05 17:04:26 UTC | 427 | IN | |
| 2024-12-05 17:04:26 UTC | 6239 | IN | |
| 2024-12-05 17:04:26 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.6 | 49817 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:27 UTC | 618 | OUT | |
| 2024-12-05 17:04:28 UTC | 291 | IN | |
| 2024-12-05 17:04:28 UTC | 7901 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 1792 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.6 | 49820 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:27 UTC | 619 | OUT | |
| 2024-12-05 17:04:28 UTC | 291 | IN | |
| 2024-12-05 17:04:28 UTC | 7901 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 6710 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.6 | 49819 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:27 UTC | 609 | OUT | |
| 2024-12-05 17:04:28 UTC | 306 | IN | |
| 2024-12-05 17:04:28 UTC | 7886 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.6 | 49818 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:27 UTC | 611 | OUT | |
| 2024-12-05 17:04:28 UTC | 306 | IN | |
| 2024-12-05 17:04:28 UTC | 7886 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN | |
| 2024-12-05 17:04:28 UTC | 8000 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.6 | 49828 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 682 | OUT | |
| 2024-12-05 17:04:30 UTC | 291 | IN | |
| 2024-12-05 17:04:30 UTC | 1226 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.6 | 49829 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 666 | OUT | |
| 2024-12-05 17:04:30 UTC | 292 | IN | |
| 2024-12-05 17:04:30 UTC | 7900 | IN | |
| 2024-12-05 17:04:30 UTC | 2742 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.6 | 49832 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 668 | OUT | |
| 2024-12-05 17:04:30 UTC | 291 | IN | |
| 2024-12-05 17:04:30 UTC | 1339 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.6 | 49831 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 668 | OUT | |
| 2024-12-05 17:04:31 UTC | 291 | IN | |
| 2024-12-05 17:04:31 UTC | 2431 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.6 | 49833 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 669 | OUT | |
| 2024-12-05 17:04:31 UTC | 291 | IN | |
| 2024-12-05 17:04:31 UTC | 7901 | IN | |
| 2024-12-05 17:04:31 UTC | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.6 | 49835 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 609 | OUT | |
| 2024-12-05 17:04:31 UTC | 305 | IN | |
| 2024-12-05 17:04:31 UTC | 7887 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 7112 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.6 | 49836 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 421 | OUT | |
| 2024-12-05 17:04:31 UTC | 306 | IN | |
| 2024-12-05 17:04:31 UTC | 7886 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.6 | 49837 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:30 UTC | 423 | OUT | |
| 2024-12-05 17:04:31 UTC | 306 | IN | |
| 2024-12-05 17:04:31 UTC | 7886 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN | |
| 2024-12-05 17:04:31 UTC | 8000 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.6 | 49839 | 62.149.0.249 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:31 UTC | 523 | OUT | |
| 2024-12-05 17:04:31 UTC | 316 | IN | |
| 2024-12-05 17:04:31 UTC | 3653 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.6 | 49846 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:32 UTC | 421 | OUT | |
| 2024-12-05 17:04:32 UTC | 291 | IN | |
| 2024-12-05 17:04:32 UTC | 1226 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.6 | 49845 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:32 UTC | 418 | OUT | |
| 2024-12-05 17:04:32 UTC | 292 | IN | |
| 2024-12-05 17:04:32 UTC | 7900 | IN | |
| 2024-12-05 17:04:32 UTC | 2742 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.6 | 49848 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:32 UTC | 420 | OUT | |
| 2024-12-05 17:04:33 UTC | 291 | IN | |
| 2024-12-05 17:04:33 UTC | 1339 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.6 | 49849 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:32 UTC | 668 | OUT | |
| 2024-12-05 17:04:33 UTC | 291 | IN | |
| 2024-12-05 17:04:33 UTC | 1442 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.6 | 49850 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:32 UTC | 420 | OUT | |
| 2024-12-05 17:04:33 UTC | 291 | IN | |
| 2024-12-05 17:04:33 UTC | 2431 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.6 | 49851 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:33 UTC | 421 | OUT | |
| 2024-12-05 17:04:33 UTC | 291 | IN | |
| 2024-12-05 17:04:33 UTC | 7901 | IN | |
| 2024-12-05 17:04:33 UTC | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.6 | 49852 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:33 UTC | 421 | OUT | |
| 2024-12-05 17:04:33 UTC | 305 | IN | |
| 2024-12-05 17:04:33 UTC | 7887 | IN | |
| 2024-12-05 17:04:33 UTC | 8000 | IN | |
| 2024-12-05 17:04:34 UTC | 8000 | IN | |
| 2024-12-05 17:04:34 UTC | 8000 | IN | |
| 2024-12-05 17:04:34 UTC | 7112 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.6 | 49855 | 62.149.0.249 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:33 UTC | 670 | OUT | |
| 2024-12-05 17:04:34 UTC | 218 | IN | |
| 2024-12-05 17:04:34 UTC | 834 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.6 | 49860 | 62.149.0.249 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:33 UTC | 353 | OUT | |
| 2024-12-05 17:04:34 UTC | 316 | IN | |
| 2024-12-05 17:04:34 UTC | 3653 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.6 | 49865 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:34 UTC | 425 | OUT | |
| 2024-12-05 17:04:35 UTC | 291 | IN | |
| 2024-12-05 17:04:35 UTC | 1442 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.6 | 49866 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:35 UTC | 650 | OUT | |
| 2024-12-05 17:04:36 UTC | 292 | IN | |
| 2024-12-05 17:04:36 UTC | 894 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.6 | 49868 | 62.149.0.249 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:35 UTC | 440 | OUT | |
| 2024-12-05 17:04:36 UTC | 218 | IN | |
| 2024-12-05 17:04:36 UTC | 834 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.6 | 49873 | 91.197.17.8 | 443 | 1616 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-05 17:04:37 UTC | 402 | OUT | |
| 2024-12-05 17:04:38 UTC | 292 | IN | |
| 2024-12-05 17:04:38 UTC | 894 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 12:03:40 |
| Start date: | 05/12/2024 |
| Path: | C:\Users\user\Desktop\izCOFC8OWh.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 88'557 bytes |
| MD5 hash: | D7326ECB2BDA34BA1DC81C821E6F32AF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 12:03:40 |
| Start date: | 05/12/2024 |
| Path: | C:\Users\user\AppData\Roaming\webcam_plugin.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 88'836 bytes |
| MD5 hash: | 3DF8C3A266B8A05D3165884FEDA0972A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 12:03:40 |
| Start date: | 05/12/2024 |
| Path: | C:\Users\user\AppData\Roaming\Microsot_Centre\webcam_plugin.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 88'836 bytes |
| MD5 hash: | 3DF8C3A266B8A05D3165884FEDA0972A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 12:03:41 |
| Start date: | 05/12/2024 |
| Path: | C:\Users\user\AppData\Roaming\Microsot_Centre\webcam_plugin.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 88'836 bytes |
| MD5 hash: | 3DF8C3A266B8A05D3165884FEDA0972A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 5 |
| Start time: | 12:03:42 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1c0000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 12:03:42 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66e660000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 7 |
| Start time: | 12:03:43 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1c0000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 12:03:43 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66e660000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 15 |
| Start time: | 12:04:18 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1c0000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 16 |
| Start time: | 12:04:18 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66e660000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 17 |
| Start time: | 12:04:18 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\SysWOW64\explorer.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xa30000 |
| File size: | 4'514'184 bytes |
| MD5 hash: | DD6597597673F72E10C9DE7901FBA0A8 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 18 |
| Start time: | 12:04:18 |
| Start date: | 05/12/2024 |
| Path: | C:\Windows\explorer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff609140000 |
| File size: | 5'141'208 bytes |
| MD5 hash: | 662F4F92FDE3557E86D110526BB578D5 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 19 |
| Start time: | 12:04:19 |
| Start date: | 05/12/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff684c40000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
| Target ID: | 22 |
| Start time: | 12:04:19 |
| Start date: | 05/12/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff684c40000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
⊘No disassembly