Edit tour
Windows
Analysis Report
1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe
Overview
General Information
| Sample name: | 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Analysis ID: | 1575960 |
| MD5: | 5b74ba5d3f7a0aff3dea2d3ae9bb1a59 |
| SHA1: | e872b3d30b3da56ac0cafb905087d595c129d73b |
| SHA256: | b84745937d020b9750842b35590589aadf47153c995f266a3f44dae8b1ff51d8 |
| Tags: | base64-decodedexeuser-abuse_ch |
| Infos: |  |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Found API chain indicative of debugger detection
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Communication To Uncommon Destination Ports
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe (PID: 6208 cmdline: "C:\Users\ user\Deskt op\1734347 766284d20d c9a2ac535c 59f41881ef e888891552 ad79abf017 10e07a6dad fae2b13366 .dat-decod ed.exe" MD5: 5B74BA5D3F7A0AFF3DEA2D3AE9BB1A59) 
WMIC.exe (PID: 3328 cmdline: wmic os ge t Name MD5: E2DE6500DE1148C7F6027AD50AC8B891) 
conhost.exe (PID: 3548 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 1928 cmdline:
wmic cpu g et name MD5: E2DE6500DE1148C7F6027AD50AC8B891) - conhost.exe (PID: 5904 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 5084 cmdline:
wmic path win32_Vide oControlle r get name MD5: E2DE6500DE1148C7F6027AD50AC8B891) - conhost.exe (PID: 3052 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-16T12:18:21.489781+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49730 | 52.17.181.189 | 443 | TCP |
| 2024-12-16T12:18:23.502993+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49731 | 34.117.59.81 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00F016A0 | |
| Source: | Code function: | 0_2_00F01651 | |
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00EF587C | |
| Source: | Code function: | 0_2_00EE9029 | |
| Source: | Code function: | 0_2_00EF8129 | |
| Source: | Code function: | 0_2_00EE83A5 | |
| Source: | Code function: | 0_2_00EF4CD7 | |
| Source: | Code function: | 0_2_00EE9CAD | |
| Source: | Code function: | 0_2_00EEAF50 | |
| Source: | Code function: | 0_2_00EF60C9 | |
| Source: | Code function: | 0_2_00EEE078 | |
| Source: | Code function: | 0_2_00EEAA69 | |
| Source: | Code function: | 0_2_00F014D0 | |
| Source: | Code function: | 0_2_00EEED20 | |
| Source: | Code function: | 0_2_00EEF6B7 | |
| Source: | Code function: | 0_2_00EFCE7D | |
| Source: | Code function: | 0_2_00EFB610 | |
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00EEAF50 | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00EE15A0 | |
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00EF573B | |
| Source: | Code function: | 0_2_00EF5486 | |
| Source: | Code function: | 0_2_00EF5493 | |
| Source: | Code function: | 0_2_00EF573B | |
| Source: | Code function: | 0_2_00EE604A | |
| Source: | Code function: | 0_2_00EE6078 | |
| Source: | Code function: | 0_2_00EE4869 | |
| Source: | Code function: | 0_2_00EE617F | |
| Source: | Code function: | 0_2_00F1427A | |
| Source: | Code function: | 0_2_00EEAC11 | |
| Source: | Code function: | 0_2_00EEAC5A | |
| Source: | Code function: | 0_2_00EF573B | |
| Source: | Code function: | 0_2_00F10320 | |
| Source: | Code function: | 0_2_00F13B0A | |
| Source: | Code function: | 0_2_00F144F4 | |
| Source: | Code function: | 0_2_00EE7521 | |
| Source: | Code function: | 0_2_00F13CDA | |
| Source: | Code function: | 0_2_00EF573B | |
| Source: | Code function: | 0_2_00EE7588 | |
| Source: | Code function: | 0_2_00F13D44 | |
| Source: | Code function: | 0_2_00F12536 | |
| Source: | Code function: | 0_2_00EEA555 | |
| Source: | Code function: | 0_2_00EEBD5A | |
| Source: | Code function: | 0_2_00EEA6EB | |
| Source: | Code function: | 0_2_00F1469B | |
| Source: | Code function: | 0_2_00EE6FF5 | |
| Source: | Code function: | 0_2_00EEBF84 | |
| Source: | Code function: | 0_2_00EE6F85 | |
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
Anti Debugging | |
|---|
| Source: | Debugger detection routine: | graph_0-20388 | ||
| Source: | Code function: | 0_2_00EF587C | |
| Source: | Code function: | 0_2_00EE15A0 | |
| Source: | Code function: | 0_2_00F028AE | |
| Source: | Code function: | 0_2_00EE1148 | |
| Source: | Code function: | 0_2_00EE1189 | |
| Source: | Code function: | 0_2_00EE1207 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00EF4227 | |
| Source: | Code function: | 0_2_00F05168 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 21 Windows Management Instrumentation | 1 DLL Side-Loading | 12 Process Injection | 121 Virtualization/Sandbox Evasion | OS Credential Dumping | 1 System Time Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Native API | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 12 Process Injection | LSASS Memory | 1 Query Registry | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Deobfuscate/Decode Files or Information | Security Account Manager | 241 Security Software Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 3 Obfuscated Files or Information | NTDS | 1 Process Discovery | Distributed Component Object Model | Input Capture | 3 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 121 Virtualization/Sandbox Evasion | SSH | Keylogging | 14 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 1 System Network Configuration Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 4 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 11% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| checkip.eu-west-1.prod.check-ip.aws.a2z.com | 52.17.181.189 | true | false | high | |
| ipinfo.io | 34.117.59.81 | true | false | high | |
| xscapezo.capetown | 31.13.224.69 | true | false | unknown | |
| checkip.amazonaws.com | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 31.13.224.69 | xscapezo.capetown | Bulgaria | 48584 | SARNICA-ASBG | false | |
| 34.117.59.81 | ipinfo.io | United States | 139070 | GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | false | |
| 52.17.181.189 | checkip.eu-west-1.prod.check-ip.aws.a2z.com | United States | 16509 | AMAZON-02US | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1575960 |
| Start date and time: | 2024-12-16 12:17:10 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 27s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Detection: | MAL |
| Classification: | mal60.evad.winEXE@10/0@3/3 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63, 52.149.20.212
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtDeviceIoControlFile calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe
| Time | Type | Description |
|---|---|---|
| 06:18:21 | API Interceptor | |
| 06:18:24 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 31.13.224.69 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| 34.117.59.81 | Get hash | malicious | Invicta Stealer, XWorm | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Neshta | Browse |
| ||
| Get hash | malicious | Neshta | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Icarus | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ipinfo.io | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Invicta Stealer, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| xscapezo.capetown | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | DarkVision Rat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| checkip.eu-west-1.prod.check-ip.aws.a2z.com | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RedLine | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| AMAZON-02US | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | Get hash | malicious | LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| SARNICA-ASBG | Get hash | malicious | Mirai, Moobot | Browse |
| |
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | AveMaria, UACMe | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC, Stealc | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Stealc | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.2915290015918925 |
| TrID: |
|
| File name: | 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| File size: | 231'936 bytes |
| MD5: | 5b74ba5d3f7a0aff3dea2d3ae9bb1a59 |
| SHA1: | e872b3d30b3da56ac0cafb905087d595c129d73b |
| SHA256: | b84745937d020b9750842b35590589aadf47153c995f266a3f44dae8b1ff51d8 |
| SHA512: | 1f4fb6efb04f3b4c57b92271996bd7008462660cd51ed6ee5144c2e073c3d090e11864ce0963ab996030b174400581699bc35d3566d2cd54a6e7137fa82114b5 |
| SSDEEP: | 3072:PtjlDNJxzpxhot+5XDTzcsNsEYwszSHRGhYlW5SQUxk5ja:Pp+tErcslYZYw9QkU |
| TLSH: | EA340815E202C4B5C43356B6998ED5A7A610BF3681239D0FBECE0F58F336B01592E76B |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>g...............$..........................@.................................W.....@... ............................ |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x4010ba |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT |
| Time Stamp: | 0x673EE9D5 [Thu Nov 21 08:05:41 2024 UTC] |
| TLS Callbacks: | 0x41a51c, 0x41a5b3, 0x4228ae |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 12964e2649ce9036e2a1286774ae86cc |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| sub esp, 18h |
| mov dword ptr [ebp-0Ch], 000000FFh |
| mov dword ptr [004382E0h], 00000001h |
| call 00007F24A46C9991h |
| mov dword ptr [ebp-0Ch], eax |
| mov eax, dword ptr [ebp-0Ch] |
| leave |
| ret |
| push ebp |
| mov ebp, esp |
| sub esp, 18h |
| mov dword ptr [ebp-0Ch], 000000FFh |
| mov dword ptr [004382E0h], 00000000h |
| call 00007F24A46C996Dh |
| mov dword ptr [ebp-0Ch], eax |
| mov eax, dword ptr [ebp-0Ch] |
| leave |
| ret |
| lea ecx, dword ptr [esp+04h] |
| and esp, FFFFFFF0h |
| push dword ptr [ecx-04h] |
| push ebp |
| mov ebp, esp |
| push ecx |
| sub esp, 00000094h |
| mov dword ptr [ebp-0Ch], 00000000h |
| mov dword ptr [ebp-10h], 00000000h |
| mov dword ptr [esp+08h], 00000044h |
| mov dword ptr [esp+04h], 00000000h |
| lea eax, dword ptr [ebp-7Ch] |
| mov dword ptr [esp], eax |
| call 00007F24A46E9156h |
| mov eax, dword ptr [004382E0h] |
| test eax, eax |
| je 00007F24A46C9972h |
| lea eax, dword ptr [ebp-7Ch] |
| mov dword ptr [esp], eax |
| mov eax, dword ptr [00439278h] |
| call eax |
| sub esp, 04h |
| mov dword ptr [ebp-18h], 00000000h |
| mov dword ptr [ebp-20h], 00000018h |
| mov eax, dword ptr [ebp-20h] |
| mov eax, dword ptr fs:[eax] |
| mov dword ptr [ebp-24h], eax |
| mov eax, dword ptr [ebp-24h] |
| mov eax, dword ptr [eax+04h] |
| mov dword ptr [ebp-1Ch], eax |
| mov dword ptr [ebp-14h], 00000000h |
| jmp 00007F24A46C9984h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x39000 | 0xd2c | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x3c000 | 0x224 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x3d000 | 0x1974 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x306c0 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x39230 | 0x1e0 | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2a684 | 0x2a800 | f192cbeafafbd036787705e45cd5893c | False | 0.43780445772058824 | data | 6.144924956418916 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .data | 0x2c000 | 0x26c | 0x400 | cd4faee918b6d039163459e9ae43b365 | False | 0.2353515625 | Matlab v4 mat-file (little endian) \240\326B, numeric, rows 0, columns 0, imaginary | 1.8158646800282847 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0x2d000 | 0x4d74 | 0x4e00 | 26a00dcabd068bb3c2a6c5d84f4dd568 | False | 0.4118088942307692 | data | 5.844738930570382 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .eh_fram | 0x32000 | 0x5a54 | 0x5c00 | cecdba5a38cd979b609cc7ed770370a6 | False | 0.3012058423913043 | data | 4.87734250713647 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .bss | 0x38000 | 0xd60 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0x39000 | 0xd2c | 0xe00 | b35ff9b62b16a100bd2cc076e9eec51e | False | 0.38253348214285715 | data | 5.085846307423846 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .CRT | 0x3a000 | 0x38 | 0x200 | be43b8407ee9c03eea15b7f75f778714 | False | 0.072265625 | data | 0.3195396310293397 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x3b000 | 0x8 | 0x200 | bf619eac0cdf3f68d496ea9344137e8b | False | 0.02734375 | data | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x3c000 | 0x224 | 0x400 | 607703b05b5f04b5884d9f6aa2c5cda8 | False | 0.3056640625 | data | 3.4103687270366034 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .reloc | 0x3d000 | 0x1974 | 0x1a00 | bcf6e1b200c8178aaf8164efda0e1e90 | False | 0.8143028846153846 | data | 6.667293120350955 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_MANIFEST | 0x3c058 | 0x1ca | XML 1.0 document, ASCII text, with very long lines (456), with CRLF line terminators | English | United States | 0.5764192139737991 |
| DLL | Import |
|---|---|
| KERNEL32.dll | AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, FreeLibrary, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetStartupInfoA, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte |
| msvcrt.dll | __getmainargs, __initenv, __lconv_init, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _fileno, _initterm, _iob, _lock, _onexit, _setjmp3, _setmode, _strdup, _ultoa, _unlock, _vsnprintf, _vsnwprintf, _wfopen, _wgetenv, abort, atoi, calloc, exit, fclose, fflush, fgetwc, fprintf, fputc, free, fwrite, getc, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, realloc, setlocale, setvbuf, signal, strchr, strerror, strlen, strncmp, vfprintf, wcslen |
| USER32.dll | MessageBoxA |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-16T12:18:21.489781+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49730 | 52.17.181.189 | 443 | TCP |
| 2024-12-16T12:18:23.502993+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49731 | 34.117.59.81 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 16, 2024 12:18:20.086318016 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:20.086353064 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:20.086427927 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:20.089668036 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:20.089692116 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:21.489557981 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:21.489780903 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:21.494684935 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:21.494702101 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:21.495143890 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:21.538237095 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:21.689815044 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:21.731329918 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:22.083914995 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:22.084013939 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:22.084108114 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:22.107765913 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:22.107767105 CET | 49730 | 443 | 192.168.2.4 | 52.17.181.189 |
| Dec 16, 2024 12:18:22.107840061 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:22.107872009 CET | 443 | 49730 | 52.17.181.189 | 192.168.2.4 |
| Dec 16, 2024 12:18:22.281847000 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:22.281892061 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:22.282263041 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:22.282763004 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:22.282787085 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.502917051 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.502993107 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:23.506222010 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:23.506242037 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.506603003 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.507936001 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:23.551425934 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.957082033 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.957166910 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.957470894 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:23.957557917 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:23.957590103 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:23.957628965 CET | 49731 | 443 | 192.168.2.4 | 34.117.59.81 |
| Dec 16, 2024 12:18:23.957638979 CET | 443 | 49731 | 34.117.59.81 | 192.168.2.4 |
| Dec 16, 2024 12:18:29.744147062 CET | 49737 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:29.864365101 CET | 8080 | 49737 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:29.864577055 CET | 49737 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:29.864702940 CET | 49737 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:29.864702940 CET | 49737 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:29.985088110 CET | 8080 | 49737 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:29.985131025 CET | 8080 | 49737 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:31.126600027 CET | 8080 | 49737 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:31.179056883 CET | 49737 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:31.244285107 CET | 49737 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:31.244872093 CET | 49739 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:31.365209103 CET | 8080 | 49737 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:31.365262985 CET | 8080 | 49739 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:31.365452051 CET | 49737 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:31.365540028 CET | 49739 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:31.365756989 CET | 49739 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:31.365756989 CET | 49739 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:31.485583067 CET | 8080 | 49739 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:31.485687971 CET | 8080 | 49739 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:32.644475937 CET | 8080 | 49739 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:32.694776058 CET | 49739 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:32.760598898 CET | 49739 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:32.761394024 CET | 49740 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:32.881159067 CET | 8080 | 49739 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:32.881398916 CET | 49739 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:32.881639004 CET | 8080 | 49740 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:32.881858110 CET | 49740 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:32.882257938 CET | 49740 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:32.882257938 CET | 49740 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:33.002357006 CET | 8080 | 49740 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:33.002397060 CET | 8080 | 49740 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:34.149986982 CET | 8080 | 49740 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:34.194711924 CET | 49740 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:34.259881020 CET | 49740 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:34.260597944 CET | 49741 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:34.380970955 CET | 8080 | 49741 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:34.381016970 CET | 8080 | 49740 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:34.381073952 CET | 49741 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:34.381095886 CET | 49740 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:34.383893967 CET | 49741 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:34.383893967 CET | 49741 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:34.504313946 CET | 8080 | 49741 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:34.504359007 CET | 8080 | 49741 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:35.632550955 CET | 8080 | 49741 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:35.679152966 CET | 49741 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:35.744199038 CET | 49741 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:35.745141029 CET | 49742 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:35.864758015 CET | 8080 | 49741 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:35.864864111 CET | 49741 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:35.865055084 CET | 8080 | 49742 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:35.865184069 CET | 49742 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:35.865670919 CET | 49742 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:35.865670919 CET | 49742 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:35.985827923 CET | 8080 | 49742 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:35.985871077 CET | 8080 | 49742 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:37.127721071 CET | 8080 | 49742 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:37.179059982 CET | 49742 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:37.244469881 CET | 49742 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:37.245306015 CET | 49743 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:37.365262985 CET | 8080 | 49742 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:37.365292072 CET | 8080 | 49743 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:37.365473986 CET | 49742 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:37.365521908 CET | 49743 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:37.365828037 CET | 49743 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:37.365828037 CET | 49743 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:37.485686064 CET | 8080 | 49743 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:37.485729933 CET | 8080 | 49743 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:38.626528025 CET | 8080 | 49743 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:38.678926945 CET | 49743 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:38.743866920 CET | 49743 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:38.744601011 CET | 49744 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:38.864729881 CET | 8080 | 49744 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:38.864785910 CET | 8080 | 49743 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:38.865156889 CET | 49743 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:38.865314007 CET | 49744 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:38.865314007 CET | 49744 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:38.871268988 CET | 49744 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:38.985388994 CET | 8080 | 49744 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:38.991281033 CET | 8080 | 49744 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:40.115755081 CET | 8080 | 49744 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:40.163383007 CET | 49744 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:40.228713989 CET | 49744 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:40.229490995 CET | 49745 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:40.349167109 CET | 8080 | 49744 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:40.349390984 CET | 8080 | 49745 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:40.349441051 CET | 49744 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:40.349679947 CET | 49745 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:40.349771023 CET | 49745 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:40.349787951 CET | 49745 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:40.469837904 CET | 8080 | 49745 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:40.469880104 CET | 8080 | 49745 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:41.614937067 CET | 8080 | 49745 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:41.663381100 CET | 49745 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:41.728754044 CET | 49745 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:41.729594946 CET | 49746 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:41.849312067 CET | 8080 | 49745 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:41.849526882 CET | 49745 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:41.849899054 CET | 8080 | 49746 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:41.849978924 CET | 49746 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:41.850178957 CET | 49746 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:41.850192070 CET | 49746 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:41.970221996 CET | 8080 | 49746 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:41.970279932 CET | 8080 | 49746 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:43.126413107 CET | 8080 | 49746 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:43.178946018 CET | 49746 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:43.244606018 CET | 49746 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:43.245304108 CET | 49747 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:43.365080118 CET | 8080 | 49746 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:43.365144968 CET | 8080 | 49747 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:43.365430117 CET | 49747 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:43.365443945 CET | 49746 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:43.365725994 CET | 49747 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:43.365751982 CET | 49747 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:43.485775948 CET | 8080 | 49747 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:43.485820055 CET | 8080 | 49747 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:44.664764881 CET | 8080 | 49747 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:44.710294008 CET | 49747 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:44.776299953 CET | 49747 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:44.777086973 CET | 49748 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:44.897037983 CET | 8080 | 49748 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:44.897084951 CET | 8080 | 49747 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:44.897559881 CET | 49748 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:44.897679090 CET | 49747 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:44.897996902 CET | 49748 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:44.897996902 CET | 49748 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:45.017822981 CET | 8080 | 49748 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:45.017854929 CET | 8080 | 49748 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:46.155132055 CET | 8080 | 49748 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:46.210205078 CET | 49748 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:46.260133982 CET | 49748 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:46.260957956 CET | 49749 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:46.381330967 CET | 8080 | 49748 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:46.381421089 CET | 8080 | 49749 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:46.381692886 CET | 49748 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:46.381709099 CET | 49749 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:46.381827116 CET | 49749 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:46.381858110 CET | 49749 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:46.502140999 CET | 8080 | 49749 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:46.502185106 CET | 8080 | 49749 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:47.679086924 CET | 8080 | 49749 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:47.726090908 CET | 49749 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:47.791404009 CET | 49749 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:47.792278051 CET | 49750 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:47.912512064 CET | 8080 | 49749 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:47.912568092 CET | 8080 | 49750 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:47.912759066 CET | 49749 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:47.912763119 CET | 49750 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:47.912899017 CET | 49750 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:47.912899017 CET | 49750 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:48.033442974 CET | 8080 | 49750 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:48.033488035 CET | 8080 | 49750 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:49.163081884 CET | 8080 | 49750 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:49.210309029 CET | 49750 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:49.282023907 CET | 49750 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:49.283112049 CET | 49751 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:49.403075933 CET | 8080 | 49750 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:49.403106928 CET | 8080 | 49751 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:49.403434038 CET | 49751 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:49.403475046 CET | 49750 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:49.403569937 CET | 49751 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:49.403615952 CET | 49751 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:49.524369001 CET | 8080 | 49751 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:49.524411917 CET | 8080 | 49751 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:50.684722900 CET | 8080 | 49751 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:50.725975990 CET | 49751 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:50.791534901 CET | 49751 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:50.792380095 CET | 49752 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:50.912817955 CET | 8080 | 49751 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:50.912861109 CET | 8080 | 49752 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:50.912925959 CET | 49751 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:50.912966967 CET | 49752 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:50.913223982 CET | 49752 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:50.913258076 CET | 49752 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:51.033076048 CET | 8080 | 49752 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:51.033132076 CET | 8080 | 49752 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:52.270313978 CET | 8080 | 49752 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:52.319813013 CET | 49752 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:52.384747028 CET | 49752 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:52.385404110 CET | 49753 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:52.505496025 CET | 8080 | 49752 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:52.505619049 CET | 49752 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:52.505687952 CET | 8080 | 49753 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:52.505779982 CET | 49753 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:52.506052971 CET | 49753 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:52.506097078 CET | 49753 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:52.626302958 CET | 8080 | 49753 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:52.626348019 CET | 8080 | 49753 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:53.830374002 CET | 8080 | 49753 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:53.882055998 CET | 49753 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:53.946822882 CET | 49753 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:53.947499037 CET | 49754 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:54.067523003 CET | 8080 | 49754 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:54.067581892 CET | 8080 | 49753 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:54.067645073 CET | 49754 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:54.067663908 CET | 49753 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:54.067876101 CET | 49754 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:54.067914009 CET | 49754 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:54.188047886 CET | 8080 | 49754 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:54.188069105 CET | 8080 | 49754 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:55.350877047 CET | 8080 | 49754 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:55.397758007 CET | 49754 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:55.491844893 CET | 49754 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:55.492425919 CET | 49755 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:55.612330914 CET | 8080 | 49754 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:55.612358093 CET | 8080 | 49755 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:55.612443924 CET | 49755 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:55.612535954 CET | 49754 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:55.612649918 CET | 49755 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:55.612649918 CET | 49755 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:55.732547045 CET | 8080 | 49755 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:55.732592106 CET | 8080 | 49755 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:56.860637903 CET | 8080 | 49755 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:56.913307905 CET | 49755 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:56.978236914 CET | 49755 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:56.978949070 CET | 49756 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:57.098877907 CET | 8080 | 49755 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:57.098927975 CET | 8080 | 49756 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:57.098978043 CET | 49755 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:57.099035978 CET | 49756 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:57.099179983 CET | 49756 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:57.099179983 CET | 49756 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:57.219108105 CET | 8080 | 49756 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:57.219129086 CET | 8080 | 49756 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:58.347475052 CET | 8080 | 49756 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:58.397833109 CET | 49756 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:58.463289976 CET | 49756 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:58.464061022 CET | 49757 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:58.584044933 CET | 8080 | 49757 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:58.584270954 CET | 49757 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:58.584530115 CET | 49757 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:58.584564924 CET | 49757 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:58.584990025 CET | 8080 | 49756 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:58.585071087 CET | 49756 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:58.704502106 CET | 8080 | 49757 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:58.704524040 CET | 8080 | 49757 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:59.869250059 CET | 8080 | 49757 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:18:59.913489103 CET | 49757 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:59.980101109 CET | 49757 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:18:59.981064081 CET | 49758 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:00.100723982 CET | 8080 | 49757 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:00.100936890 CET | 8080 | 49758 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:00.101007938 CET | 49757 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:00.101080894 CET | 49758 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:00.101306915 CET | 49758 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:00.101344109 CET | 49758 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:00.221246958 CET | 8080 | 49758 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:00.221271992 CET | 8080 | 49758 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:01.375282049 CET | 8080 | 49758 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:01.429059982 CET | 49758 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:01.493789911 CET | 49758 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:01.494616032 CET | 49760 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:01.614728928 CET | 8080 | 49758 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:01.614831924 CET | 8080 | 49760 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:01.615031958 CET | 49760 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:01.615096092 CET | 49758 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:01.615132093 CET | 49760 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:01.615133047 CET | 49760 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:01.735330105 CET | 8080 | 49760 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:01.735452890 CET | 8080 | 49760 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:03.469422102 CET | 8080 | 49760 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:03.522702932 CET | 49760 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:03.598319054 CET | 49760 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:03.602103949 CET | 49761 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:03.718687057 CET | 8080 | 49760 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:03.718772888 CET | 49760 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:03.722047091 CET | 8080 | 49761 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:03.722151041 CET | 49761 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:03.725904942 CET | 49761 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:03.725944042 CET | 49761 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:03.847950935 CET | 8080 | 49761 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:03.847994089 CET | 8080 | 49761 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:06.495816946 CET | 8080 | 49761 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:06.538502932 CET | 49761 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:06.603055954 CET | 49761 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:06.603717089 CET | 49773 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:06.724657059 CET | 8080 | 49773 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:06.724737883 CET | 49773 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:06.724852085 CET | 8080 | 49761 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:06.724906921 CET | 49761 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:06.724934101 CET | 49773 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:06.724983931 CET | 49773 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:06.844758987 CET | 8080 | 49773 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:06.844795942 CET | 8080 | 49773 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:07.976933956 CET | 8080 | 49773 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:08.022905111 CET | 49773 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:08.087862968 CET | 49773 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:08.088362932 CET | 49774 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:08.208631039 CET | 8080 | 49774 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:08.208725929 CET | 8080 | 49773 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:08.208817959 CET | 49774 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:08.208868980 CET | 49773 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:08.209032059 CET | 49774 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:08.209096909 CET | 49774 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:08.329257965 CET | 8080 | 49774 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:08.329312086 CET | 8080 | 49774 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:09.454586983 CET | 8080 | 49774 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:09.507119894 CET | 49774 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:09.572236061 CET | 49774 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:09.572884083 CET | 49780 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:09.692992926 CET | 8080 | 49774 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:09.693051100 CET | 8080 | 49780 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:09.693145037 CET | 49780 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:09.693180084 CET | 49774 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:09.693304062 CET | 49780 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:09.693365097 CET | 49780 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:09.813496113 CET | 8080 | 49780 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:09.813540936 CET | 8080 | 49780 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:10.974291086 CET | 8080 | 49780 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:11.022739887 CET | 49780 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:11.087672949 CET | 49780 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:11.088393927 CET | 49786 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:11.212604046 CET | 8080 | 49786 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:11.212703943 CET | 49786 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:11.212800026 CET | 8080 | 49780 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:11.212865114 CET | 49780 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:11.212908983 CET | 49786 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:11.212937117 CET | 49786 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:11.332655907 CET | 8080 | 49786 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:11.332715034 CET | 8080 | 49786 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:12.523499012 CET | 8080 | 49786 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:12.569698095 CET | 49786 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:12.636291027 CET | 49786 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:12.637212038 CET | 49787 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:12.757343054 CET | 8080 | 49786 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:12.757499933 CET | 8080 | 49787 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:12.757498026 CET | 49786 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:12.757725954 CET | 49787 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:12.757860899 CET | 49787 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:12.757898092 CET | 49787 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:12.877873898 CET | 8080 | 49787 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:12.877919912 CET | 8080 | 49787 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:14.004390001 CET | 8080 | 49787 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:14.054166079 CET | 49787 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:14.119349957 CET | 49787 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:14.120141983 CET | 49793 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:14.241156101 CET | 8080 | 49787 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:14.241272926 CET | 49787 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:14.241437912 CET | 8080 | 49793 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:14.241528988 CET | 49793 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:14.243379116 CET | 49793 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:14.243415117 CET | 49793 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:14.363586903 CET | 8080 | 49793 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:14.363631964 CET | 8080 | 49793 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:15.572176933 CET | 8080 | 49793 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:15.616574049 CET | 49793 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:15.682405949 CET | 49793 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:15.683162928 CET | 49799 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:15.803153038 CET | 8080 | 49793 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:15.803181887 CET | 8080 | 49799 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:15.803425074 CET | 49799 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:15.803481102 CET | 49793 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:15.803679943 CET | 49799 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:15.803716898 CET | 49799 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:15.924010992 CET | 8080 | 49799 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:15.924063921 CET | 8080 | 49799 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:17.071687937 CET | 8080 | 49799 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:17.116619110 CET | 49799 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:17.182447910 CET | 49799 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:17.183437109 CET | 49804 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:17.303329945 CET | 8080 | 49799 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:17.303417921 CET | 49799 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:17.303546906 CET | 8080 | 49804 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:17.303630114 CET | 49804 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:17.303875923 CET | 49804 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:17.303929090 CET | 49804 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:17.423537970 CET | 8080 | 49804 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:17.423553944 CET | 8080 | 49804 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:18.557284117 CET | 8080 | 49804 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:18.600878000 CET | 49804 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:18.666831017 CET | 49804 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:18.667531967 CET | 49806 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:18.787400007 CET | 8080 | 49806 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:18.787507057 CET | 49806 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:18.787631035 CET | 8080 | 49804 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:18.787683010 CET | 49804 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:18.787877083 CET | 49806 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:18.787914038 CET | 49806 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:18.907649040 CET | 8080 | 49806 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:18.907690048 CET | 8080 | 49806 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:20.463035107 CET | 8080 | 49806 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:20.463202000 CET | 8080 | 49806 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:20.463270903 CET | 49806 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:20.572480917 CET | 49806 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:20.573276997 CET | 49812 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:20.692775011 CET | 8080 | 49806 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:20.693063021 CET | 49806 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:20.693233013 CET | 8080 | 49812 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:20.693317890 CET | 49812 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:20.693550110 CET | 49812 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:20.693583965 CET | 49812 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:20.814364910 CET | 8080 | 49812 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:20.814421892 CET | 8080 | 49812 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:22.024398088 CET | 8080 | 49812 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:22.069827080 CET | 49812 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:22.135358095 CET | 49812 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:22.136256933 CET | 49818 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:22.256331921 CET | 8080 | 49812 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:22.256376982 CET | 8080 | 49818 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:22.256406069 CET | 49812 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:22.256486893 CET | 49818 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:22.256730080 CET | 49818 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:22.256769896 CET | 49818 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:22.376802921 CET | 8080 | 49818 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:22.376838923 CET | 8080 | 49818 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:23.528111935 CET | 8080 | 49818 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:23.569628000 CET | 49818 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:23.637379885 CET | 49818 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:23.638010025 CET | 49821 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:23.757417917 CET | 8080 | 49818 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:23.757508039 CET | 49818 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:23.757729053 CET | 8080 | 49821 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:23.757813931 CET | 49821 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:23.757987022 CET | 49821 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:23.758012056 CET | 49821 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:23.877897024 CET | 8080 | 49821 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:23.877928019 CET | 8080 | 49821 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:25.000852108 CET | 8080 | 49821 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:25.054126024 CET | 49821 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:25.119617939 CET | 49821 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:25.120265961 CET | 49825 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:25.239779949 CET | 8080 | 49821 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:25.239896059 CET | 49821 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:25.240003109 CET | 8080 | 49825 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:25.240086079 CET | 49825 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:25.240271091 CET | 49825 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:25.240309954 CET | 49825 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:25.360053062 CET | 8080 | 49825 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:25.360270023 CET | 8080 | 49825 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:26.498600960 CET | 8080 | 49825 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:26.554085970 CET | 49825 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:26.603641033 CET | 49825 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:26.604283094 CET | 49831 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:26.724252939 CET | 8080 | 49825 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:26.724345922 CET | 8080 | 49831 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:26.724462986 CET | 49831 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:26.724497080 CET | 49825 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:26.724651098 CET | 49831 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:26.724669933 CET | 49831 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:26.844549894 CET | 8080 | 49831 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:26.844594002 CET | 8080 | 49831 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:27.987004042 CET | 8080 | 49831 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:28.038409948 CET | 49831 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:28.103750944 CET | 49831 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:28.104671955 CET | 49832 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:28.224117041 CET | 8080 | 49831 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:28.224229097 CET | 49831 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:28.224417925 CET | 8080 | 49832 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:28.224541903 CET | 49832 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:28.224751949 CET | 49832 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:28.224788904 CET | 49832 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:28.344574928 CET | 8080 | 49832 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:28.344605923 CET | 8080 | 49832 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:29.470256090 CET | 8080 | 49832 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:29.522882938 CET | 49832 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:29.592024088 CET | 49832 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:29.592931986 CET | 49838 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:29.712397099 CET | 8080 | 49832 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:29.712503910 CET | 49832 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:29.712902069 CET | 8080 | 49838 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:29.713006020 CET | 49838 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:29.713224888 CET | 49838 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:29.713264942 CET | 49838 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:29.833039999 CET | 8080 | 49838 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:29.833118916 CET | 8080 | 49838 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:30.980479956 CET | 8080 | 49838 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:31.022849083 CET | 49838 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:31.087841988 CET | 49838 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:31.089824915 CET | 49844 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:31.208482981 CET | 8080 | 49838 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:31.209408045 CET | 49838 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:31.209749937 CET | 8080 | 49844 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:31.209934950 CET | 49844 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:31.209961891 CET | 49844 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:31.209975958 CET | 49844 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:31.330081940 CET | 8080 | 49844 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:31.330147028 CET | 8080 | 49844 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:32.459955931 CET | 8080 | 49844 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:32.507150888 CET | 49844 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:32.572594881 CET | 49844 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:32.573489904 CET | 49845 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:32.693166018 CET | 8080 | 49844 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:32.693243027 CET | 49844 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:32.693540096 CET | 8080 | 49845 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:32.693633080 CET | 49845 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:32.695274115 CET | 49845 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:32.695274115 CET | 49845 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:32.815803051 CET | 8080 | 49845 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:32.815841913 CET | 8080 | 49845 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:33.964093924 CET | 8080 | 49845 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:34.007153034 CET | 49845 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:34.072426081 CET | 49845 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:34.072961092 CET | 49851 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:34.193351030 CET | 8080 | 49845 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:34.193423986 CET | 8080 | 49851 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:34.193588972 CET | 49845 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:34.193780899 CET | 49851 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:34.193780899 CET | 49851 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:34.197758913 CET | 49851 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:34.313584089 CET | 8080 | 49851 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:34.317574978 CET | 8080 | 49851 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:35.497426033 CET | 8080 | 49851 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:35.538636923 CET | 49851 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:35.603321075 CET | 49851 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:35.603868961 CET | 49857 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:35.723701954 CET | 8080 | 49851 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:35.723745108 CET | 8080 | 49857 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:35.723823071 CET | 49851 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:35.723860025 CET | 49857 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:35.724056959 CET | 49857 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:35.724093914 CET | 49857 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:35.843847990 CET | 8080 | 49857 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:35.843904972 CET | 8080 | 49857 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:37.048379898 CET | 8080 | 49857 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:37.100929022 CET | 49857 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:37.172569990 CET | 49857 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:37.173562050 CET | 49862 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:37.292650938 CET | 8080 | 49857 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:37.292730093 CET | 49857 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:37.293744087 CET | 8080 | 49862 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:37.294127941 CET | 49862 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:37.294127941 CET | 49862 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:37.294127941 CET | 49862 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:37.414077044 CET | 8080 | 49862 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:37.414108992 CET | 8080 | 49862 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:38.602039099 CET | 8080 | 49862 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:38.647883892 CET | 49862 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:38.713701010 CET | 49862 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:38.714693069 CET | 49864 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:38.834027052 CET | 8080 | 49862 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:38.834300041 CET | 49862 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:38.834485054 CET | 8080 | 49864 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:38.834583044 CET | 49864 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:38.834815979 CET | 49864 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:38.834847927 CET | 49864 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:38.955900908 CET | 8080 | 49864 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:38.955970049 CET | 8080 | 49864 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:40.110639095 CET | 8080 | 49864 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:40.163567066 CET | 49864 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:40.229621887 CET | 49864 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:40.230528116 CET | 49870 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:40.350559950 CET | 8080 | 49864 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:40.350675106 CET | 49864 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:40.351016045 CET | 8080 | 49870 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:40.351133108 CET | 49870 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:40.351411104 CET | 49870 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:40.351471901 CET | 49870 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:40.471458912 CET | 8080 | 49870 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:40.471508026 CET | 8080 | 49870 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:41.613267899 CET | 8080 | 49870 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:41.663506985 CET | 49870 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:41.792742968 CET | 49870 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:41.793734074 CET | 49876 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:41.913069010 CET | 8080 | 49870 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:41.913136959 CET | 49870 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:41.913552999 CET | 8080 | 49876 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:41.913674116 CET | 49876 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:41.919815063 CET | 49876 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:41.919855118 CET | 49876 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:42.039767981 CET | 8080 | 49876 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:42.039808035 CET | 8080 | 49876 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:43.175744057 CET | 8080 | 49876 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:43.225969076 CET | 49876 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:43.291335106 CET | 49876 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:43.310494900 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:43.411717892 CET | 8080 | 49876 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:43.411787033 CET | 49876 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:43.430296898 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:43.430394888 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:43.432024002 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:43.432056904 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:43.551830053 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:43.551878929 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:44.708137989 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:44.757158995 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:44.822911978 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:44.822963953 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:44.942898035 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:44.942934036 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:45.367132902 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:45.413466930 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:45.479046106 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:45.479784012 CET | 49883 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:45.599253893 CET | 8080 | 49877 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:45.599783897 CET | 8080 | 49883 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:45.600034952 CET | 49877 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:45.600083113 CET | 49883 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:45.600503922 CET | 49883 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:45.600533009 CET | 49883 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:45.720380068 CET | 8080 | 49883 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:45.720434904 CET | 8080 | 49883 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:46.893455982 CET | 8080 | 49883 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:46.944690943 CET | 49883 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:47.011379957 CET | 49883 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:47.012279034 CET | 49888 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:47.131429911 CET | 8080 | 49883 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:47.131587029 CET | 49883 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:47.132116079 CET | 8080 | 49888 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:47.132215023 CET | 49888 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:47.132656097 CET | 49888 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:47.132714987 CET | 49888 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:47.252593040 CET | 8080 | 49888 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:47.252613068 CET | 8080 | 49888 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:48.420160055 CET | 8080 | 49888 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:48.460426092 CET | 49888 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:48.525867939 CET | 49888 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:48.526706934 CET | 49894 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:48.648452044 CET | 8080 | 49894 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:48.648597956 CET | 49894 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:48.648991108 CET | 8080 | 49888 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:48.649163961 CET | 49888 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:48.659271002 CET | 49894 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:48.659271002 CET | 49894 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:48.779392958 CET | 8080 | 49894 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:48.779413939 CET | 8080 | 49894 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:50.067240953 CET | 8080 | 49894 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:50.116556883 CET | 49894 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:50.192096949 CET | 49894 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:50.192887068 CET | 49897 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:50.312571049 CET | 8080 | 49894 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:50.312633991 CET | 49894 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:50.312979937 CET | 8080 | 49897 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:50.313047886 CET | 49897 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:50.313195944 CET | 49897 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:50.313214064 CET | 49897 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:50.432872057 CET | 8080 | 49897 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:50.432887077 CET | 8080 | 49897 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:51.581099987 CET | 8080 | 49897 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:51.632349014 CET | 49897 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:51.700239897 CET | 49897 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:51.703659058 CET | 49902 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:51.820489883 CET | 8080 | 49897 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:51.820601940 CET | 49897 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:51.823487043 CET | 8080 | 49902 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:51.823596001 CET | 49902 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:51.823754072 CET | 49902 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:51.823771000 CET | 49902 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:51.943572998 CET | 8080 | 49902 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:51.943604946 CET | 8080 | 49902 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:53.123792887 CET | 8080 | 49902 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:53.179076910 CET | 49902 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:53.229223013 CET | 49902 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:53.230557919 CET | 49907 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:53.349558115 CET | 8080 | 49902 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:53.349853039 CET | 49902 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:53.350491047 CET | 8080 | 49907 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:53.350720882 CET | 49907 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:53.351125002 CET | 49907 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:53.351140976 CET | 49907 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:53.470904112 CET | 8080 | 49907 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:53.470928907 CET | 8080 | 49907 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:54.639369011 CET | 8080 | 49907 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:54.694700956 CET | 49907 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:54.908380032 CET | 49907 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:54.909229994 CET | 49909 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:55.028671980 CET | 8080 | 49907 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:55.028752089 CET | 49907 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:55.028994083 CET | 8080 | 49909 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:55.029076099 CET | 49909 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:55.029300928 CET | 49909 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:55.029323101 CET | 49909 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:55.149347067 CET | 8080 | 49909 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:55.149394989 CET | 8080 | 49909 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:56.317684889 CET | 8080 | 49909 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:56.366580963 CET | 49909 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:56.431449890 CET | 49909 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:56.432235956 CET | 49915 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:56.552223921 CET | 8080 | 49915 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:56.552258968 CET | 8080 | 49909 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:56.552324057 CET | 49909 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:56.552414894 CET | 49915 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:56.552582979 CET | 49915 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:56.552632093 CET | 49915 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:56.672825098 CET | 8080 | 49915 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:56.672851086 CET | 8080 | 49915 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:57.823740005 CET | 8080 | 49915 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:57.866552114 CET | 49915 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:57.931792021 CET | 49915 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:57.932564020 CET | 49920 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:58.052236080 CET | 8080 | 49915 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:58.052299023 CET | 49915 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:58.052450895 CET | 8080 | 49920 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:58.052531958 CET | 49920 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:58.052759886 CET | 49920 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:58.052788019 CET | 49920 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:58.172780037 CET | 8080 | 49920 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:58.172801018 CET | 8080 | 49920 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:59.307533979 CET | 8080 | 49920 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:59.351118088 CET | 49920 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:59.416918993 CET | 49920 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:59.417665958 CET | 49926 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:59.537141085 CET | 8080 | 49920 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:59.537214041 CET | 49920 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:59.537405014 CET | 8080 | 49926 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:59.537502050 CET | 49926 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:59.537695885 CET | 49926 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:59.537730932 CET | 49926 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:19:59.657370090 CET | 8080 | 49926 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:19:59.657470942 CET | 8080 | 49926 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:00.806158066 CET | 8080 | 49926 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:00.851027012 CET | 49926 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:00.916399956 CET | 49926 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:00.917195082 CET | 49928 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:01.036854982 CET | 8080 | 49926 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:01.037072897 CET | 8080 | 49928 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:01.037079096 CET | 49926 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:01.037211895 CET | 49928 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:01.037542105 CET | 49928 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:01.037621975 CET | 49928 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:01.157485008 CET | 8080 | 49928 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:01.157525063 CET | 8080 | 49928 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:02.316968918 CET | 8080 | 49928 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:02.366625071 CET | 49928 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:02.454902887 CET | 49928 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:02.455406904 CET | 49932 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:02.575226068 CET | 8080 | 49928 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:02.575251102 CET | 8080 | 49932 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:02.575294018 CET | 49928 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:02.575366020 CET | 49932 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:02.621758938 CET | 49932 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:02.621805906 CET | 49932 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:02.741646051 CET | 8080 | 49932 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:02.741671085 CET | 8080 | 49932 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:04.030149937 CET | 8080 | 49932 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:04.069894075 CET | 49932 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:04.134984016 CET | 49932 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:04.135776043 CET | 49936 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:04.255956888 CET | 8080 | 49932 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:04.256002903 CET | 8080 | 49936 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:04.256278992 CET | 49936 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:04.256405115 CET | 49936 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:04.256405115 CET | 49936 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:04.256422997 CET | 49932 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:04.376408100 CET | 8080 | 49936 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:04.376594067 CET | 8080 | 49936 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:05.513976097 CET | 8080 | 49936 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:05.569725990 CET | 49936 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:05.621978998 CET | 49936 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:05.622720957 CET | 49941 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:05.742489100 CET | 8080 | 49941 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:05.742523909 CET | 8080 | 49936 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:05.742582083 CET | 49941 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:05.742708921 CET | 49936 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:05.742789030 CET | 49941 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:05.742789030 CET | 49941 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:05.862818956 CET | 8080 | 49941 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:05.862910032 CET | 8080 | 49941 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:06.998188972 CET | 8080 | 49941 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:07.038496971 CET | 49941 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:07.104238033 CET | 49941 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:07.105081081 CET | 49945 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:07.224658966 CET | 8080 | 49941 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:07.224852085 CET | 8080 | 49945 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:07.224909067 CET | 49941 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:07.225100994 CET | 49945 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:07.225100994 CET | 49945 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:07.225137949 CET | 49945 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:07.345304012 CET | 8080 | 49945 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:07.345330000 CET | 8080 | 49945 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:08.529226065 CET | 8080 | 49945 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:08.569837093 CET | 49945 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:08.637360096 CET | 49945 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:08.638362885 CET | 49949 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:08.757949114 CET | 8080 | 49945 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:08.758038044 CET | 49945 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:08.758452892 CET | 8080 | 49949 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:08.758568048 CET | 49949 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:08.758769989 CET | 49949 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:08.758804083 CET | 49949 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:08.879029989 CET | 8080 | 49949 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:08.879082918 CET | 8080 | 49949 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:10.064316988 CET | 8080 | 49949 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:10.116878986 CET | 49949 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:10.181963921 CET | 49949 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:10.182553053 CET | 49955 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:10.302445889 CET | 8080 | 49949 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:10.302464008 CET | 8080 | 49955 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:10.302557945 CET | 49955 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:10.302632093 CET | 49949 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:10.302959919 CET | 49955 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:10.303052902 CET | 49955 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:10.422738075 CET | 8080 | 49955 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:10.422768116 CET | 8080 | 49955 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:11.619467020 CET | 8080 | 49955 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:11.663609982 CET | 49955 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:11.728470087 CET | 49955 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:11.729221106 CET | 49958 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:11.848856926 CET | 8080 | 49955 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:11.849087000 CET | 49955 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:11.850011110 CET | 8080 | 49958 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:11.850202084 CET | 49958 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:11.850428104 CET | 49958 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:11.850461960 CET | 49958 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Dec 16, 2024 12:20:11.970453024 CET | 8080 | 49958 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:11.970474005 CET | 8080 | 49958 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:13.461311102 CET | 8080 | 49958 | 31.13.224.69 | 192.168.2.4 |
| Dec 16, 2024 12:20:13.507235050 CET | 49958 | 8080 | 192.168.2.4 | 31.13.224.69 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 16, 2024 12:18:19.943370104 CET | 63512 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 12:18:20.081660032 CET | 53 | 63512 | 1.1.1.1 | 192.168.2.4 |
| Dec 16, 2024 12:18:22.142328024 CET | 61125 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 12:18:22.280951977 CET | 53 | 61125 | 1.1.1.1 | 192.168.2.4 |
| Dec 16, 2024 12:18:29.230524063 CET | 62274 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 12:18:29.743118048 CET | 53 | 62274 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 16, 2024 12:18:19.943370104 CET | 192.168.2.4 | 1.1.1.1 | 0x9f1e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 16, 2024 12:18:22.142328024 CET | 192.168.2.4 | 1.1.1.1 | 0x4fb8 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 16, 2024 12:18:29.230524063 CET | 192.168.2.4 | 1.1.1.1 | 0x78e6 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 16, 2024 12:18:20.081660032 CET | 1.1.1.1 | 192.168.2.4 | 0x9f1e | No error (0) | checkip.check-ip.aws.a2z.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 16, 2024 12:18:20.081660032 CET | 1.1.1.1 | 192.168.2.4 | 0x9f1e | No error (0) | checkip.eu-west-1.prod.check-ip.aws.a2z.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 16, 2024 12:18:20.081660032 CET | 1.1.1.1 | 192.168.2.4 | 0x9f1e | No error (0) | 52.17.181.189 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 12:18:20.081660032 CET | 1.1.1.1 | 192.168.2.4 | 0x9f1e | No error (0) | 54.195.26.29 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 12:18:20.081660032 CET | 1.1.1.1 | 192.168.2.4 | 0x9f1e | No error (0) | 18.202.169.9 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 12:18:22.280951977 CET | 1.1.1.1 | 192.168.2.4 | 0x4fb8 | No error (0) | 34.117.59.81 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 12:18:29.743118048 CET | 1.1.1.1 | 192.168.2.4 | 0x78e6 | No error (0) | 31.13.224.69 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49737 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:29.864702940 CET | 225 | OUT | |
| Dec 16, 2024 12:18:31.126600027 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49739 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:31.365756989 CET | 225 | OUT | |
| Dec 16, 2024 12:18:32.644475937 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49740 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:32.882257938 CET | 225 | OUT | |
| Dec 16, 2024 12:18:34.149986982 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49741 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:34.383893967 CET | 225 | OUT | |
| Dec 16, 2024 12:18:35.632550955 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49742 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:35.865670919 CET | 225 | OUT | |
| Dec 16, 2024 12:18:37.127721071 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49743 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:37.365828037 CET | 225 | OUT | |
| Dec 16, 2024 12:18:38.626528025 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49744 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:38.865314007 CET | 225 | OUT | |
| Dec 16, 2024 12:18:40.115755081 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49745 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:40.349771023 CET | 225 | OUT | |
| Dec 16, 2024 12:18:41.614937067 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49746 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:41.850178957 CET | 225 | OUT | |
| Dec 16, 2024 12:18:43.126413107 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49747 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:43.365725994 CET | 225 | OUT | |
| Dec 16, 2024 12:18:44.664764881 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49748 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:44.897996902 CET | 225 | OUT | |
| Dec 16, 2024 12:18:46.155132055 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.4 | 49749 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:46.381827116 CET | 225 | OUT | |
| Dec 16, 2024 12:18:47.679086924 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.4 | 49750 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:47.912899017 CET | 225 | OUT | |
| Dec 16, 2024 12:18:49.163081884 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.4 | 49751 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:49.403569937 CET | 225 | OUT | |
| Dec 16, 2024 12:18:50.684722900 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.4 | 49752 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:50.913223982 CET | 225 | OUT | |
| Dec 16, 2024 12:18:52.270313978 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.4 | 49753 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:52.506052971 CET | 225 | OUT | |
| Dec 16, 2024 12:18:53.830374002 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.4 | 49754 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:54.067876101 CET | 225 | OUT | |
| Dec 16, 2024 12:18:55.350877047 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.4 | 49755 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:55.612649918 CET | 225 | OUT | |
| Dec 16, 2024 12:18:56.860637903 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.4 | 49756 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:57.099179983 CET | 225 | OUT | |
| Dec 16, 2024 12:18:58.347475052 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.4 | 49757 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:18:58.584530115 CET | 225 | OUT | |
| Dec 16, 2024 12:18:59.869250059 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.4 | 49758 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:00.101306915 CET | 225 | OUT | |
| Dec 16, 2024 12:19:01.375282049 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.4 | 49760 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:01.615132093 CET | 225 | OUT | |
| Dec 16, 2024 12:19:03.469422102 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.4 | 49761 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:03.725904942 CET | 225 | OUT | |
| Dec 16, 2024 12:19:06.495816946 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.4 | 49773 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:06.724934101 CET | 225 | OUT | |
| Dec 16, 2024 12:19:07.976933956 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.4 | 49774 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:08.209032059 CET | 225 | OUT | |
| Dec 16, 2024 12:19:09.454586983 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.4 | 49780 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:09.693304062 CET | 225 | OUT | |
| Dec 16, 2024 12:19:10.974291086 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.4 | 49786 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:11.212908983 CET | 225 | OUT | |
| Dec 16, 2024 12:19:12.523499012 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 27 | 192.168.2.4 | 49787 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:12.757860899 CET | 225 | OUT | |
| Dec 16, 2024 12:19:14.004390001 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 28 | 192.168.2.4 | 49793 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:14.243379116 CET | 225 | OUT | |
| Dec 16, 2024 12:19:15.572176933 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 29 | 192.168.2.4 | 49799 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:15.803679943 CET | 225 | OUT | |
| Dec 16, 2024 12:19:17.071687937 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 30 | 192.168.2.4 | 49804 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:17.303875923 CET | 225 | OUT | |
| Dec 16, 2024 12:19:18.557284117 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 31 | 192.168.2.4 | 49806 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:18.787877083 CET | 225 | OUT | |
| Dec 16, 2024 12:19:20.463035107 CET | 167 | IN | |
| Dec 16, 2024 12:19:20.463202000 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 32 | 192.168.2.4 | 49812 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:20.693550110 CET | 225 | OUT | |
| Dec 16, 2024 12:19:22.024398088 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 33 | 192.168.2.4 | 49818 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:22.256730080 CET | 225 | OUT | |
| Dec 16, 2024 12:19:23.528111935 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 34 | 192.168.2.4 | 49821 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:23.757987022 CET | 225 | OUT | |
| Dec 16, 2024 12:19:25.000852108 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 35 | 192.168.2.4 | 49825 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:25.240271091 CET | 225 | OUT | |
| Dec 16, 2024 12:19:26.498600960 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 36 | 192.168.2.4 | 49831 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:26.724651098 CET | 225 | OUT | |
| Dec 16, 2024 12:19:27.987004042 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 37 | 192.168.2.4 | 49832 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:28.224751949 CET | 225 | OUT | |
| Dec 16, 2024 12:19:29.470256090 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 38 | 192.168.2.4 | 49838 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:29.713224888 CET | 225 | OUT | |
| Dec 16, 2024 12:19:30.980479956 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 39 | 192.168.2.4 | 49844 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:31.209961891 CET | 225 | OUT | |
| Dec 16, 2024 12:19:32.459955931 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 40 | 192.168.2.4 | 49845 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:32.695274115 CET | 225 | OUT | |
| Dec 16, 2024 12:19:33.964093924 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 41 | 192.168.2.4 | 49851 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:34.193780899 CET | 225 | OUT | |
| Dec 16, 2024 12:19:35.497426033 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 42 | 192.168.2.4 | 49857 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:35.724056959 CET | 225 | OUT | |
| Dec 16, 2024 12:19:37.048379898 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 43 | 192.168.2.4 | 49862 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:37.294127941 CET | 225 | OUT | |
| Dec 16, 2024 12:19:38.602039099 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 44 | 192.168.2.4 | 49864 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:38.834815979 CET | 225 | OUT | |
| Dec 16, 2024 12:19:40.110639095 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 45 | 192.168.2.4 | 49870 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:40.351411104 CET | 225 | OUT | |
| Dec 16, 2024 12:19:41.613267899 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 46 | 192.168.2.4 | 49876 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:41.919815063 CET | 225 | OUT | |
| Dec 16, 2024 12:19:43.175744057 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 47 | 192.168.2.4 | 49877 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:43.432024002 CET | 225 | OUT | |
| Dec 16, 2024 12:19:44.708137989 CET | 167 | IN | |
| Dec 16, 2024 12:19:44.822911978 CET | 225 | OUT | |
| Dec 16, 2024 12:19:45.367132902 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 48 | 192.168.2.4 | 49883 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:45.600503922 CET | 225 | OUT | |
| Dec 16, 2024 12:19:46.893455982 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 49 | 192.168.2.4 | 49888 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:47.132656097 CET | 225 | OUT | |
| Dec 16, 2024 12:19:48.420160055 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 50 | 192.168.2.4 | 49894 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:48.659271002 CET | 225 | OUT | |
| Dec 16, 2024 12:19:50.067240953 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 51 | 192.168.2.4 | 49897 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:50.313195944 CET | 225 | OUT | |
| Dec 16, 2024 12:19:51.581099987 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 52 | 192.168.2.4 | 49902 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:51.823754072 CET | 225 | OUT | |
| Dec 16, 2024 12:19:53.123792887 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 53 | 192.168.2.4 | 49907 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:53.351125002 CET | 225 | OUT | |
| Dec 16, 2024 12:19:54.639369011 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 54 | 192.168.2.4 | 49909 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:55.029300928 CET | 225 | OUT | |
| Dec 16, 2024 12:19:56.317684889 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 55 | 192.168.2.4 | 49915 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:56.552582979 CET | 225 | OUT | |
| Dec 16, 2024 12:19:57.823740005 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 56 | 192.168.2.4 | 49920 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:58.052759886 CET | 225 | OUT | |
| Dec 16, 2024 12:19:59.307533979 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 57 | 192.168.2.4 | 49926 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:19:59.537695885 CET | 225 | OUT | |
| Dec 16, 2024 12:20:00.806158066 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 58 | 192.168.2.4 | 49928 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:01.037542105 CET | 225 | OUT | |
| Dec 16, 2024 12:20:02.316968918 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 59 | 192.168.2.4 | 49932 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:02.621758938 CET | 225 | OUT | |
| Dec 16, 2024 12:20:04.030149937 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 60 | 192.168.2.4 | 49936 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:04.256405115 CET | 225 | OUT | |
| Dec 16, 2024 12:20:05.513976097 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 61 | 192.168.2.4 | 49941 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:05.742789030 CET | 225 | OUT | |
| Dec 16, 2024 12:20:06.998188972 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 62 | 192.168.2.4 | 49945 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:07.225100994 CET | 225 | OUT | |
| Dec 16, 2024 12:20:08.529226065 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 63 | 192.168.2.4 | 49949 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:08.758769989 CET | 225 | OUT | |
| Dec 16, 2024 12:20:10.064316988 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 64 | 192.168.2.4 | 49955 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:10.302959919 CET | 225 | OUT | |
| Dec 16, 2024 12:20:11.619467020 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 65 | 192.168.2.4 | 49958 | 31.13.224.69 | 8080 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 12:20:11.850428104 CET | 225 | OUT | |
| Dec 16, 2024 12:20:13.461311102 CET | 167 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 52.17.181.189 | 443 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 11:18:21 UTC | 187 | OUT | |
| 2024-12-16 11:18:22 UTC | 237 | IN | |
| 2024-12-16 11:18:22 UTC | 13 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49731 | 34.117.59.81 | 443 | 6208 | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 11:18:23 UTC | 182 | OUT | |
| 2024-12-16 11:18:23 UTC | 448 | IN | |
| 2024-12-16 11:18:23 UTC | 3 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 06:18:06 |
| Start date: | 16/12/2024 |
| Path: | C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xee0000 |
| File size: | 231'936 bytes |
| MD5 hash: | 5B74BA5D3F7A0AFF3DEA2D3AE9BB1A59 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 2 |
| Start time: | 06:18:23 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\SysWOW64\wbem\WMIC.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x930000 |
| File size: | 427'008 bytes |
| MD5 hash: | E2DE6500DE1148C7F6027AD50AC8B891 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 06:18:23 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 06:18:24 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\SysWOW64\wbem\WMIC.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x930000 |
| File size: | 427'008 bytes |
| MD5 hash: | E2DE6500DE1148C7F6027AD50AC8B891 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 06:18:24 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 06:18:26 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\SysWOW64\wbem\WMIC.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x930000 |
| File size: | 427'008 bytes |
| MD5 hash: | E2DE6500DE1148C7F6027AD50AC8B891 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 06:18:26 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 7% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 46.7% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 97 |
Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EEAF50 Relevance: 18.4, APIs: 6, Strings: 4, Instructions: 898comCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F016A0 Relevance: 12.1, APIs: 8, Instructions: 139COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE1148 Relevance: 7.6, APIs: 5, Instructions: 146COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE1189 Relevance: 7.6, APIs: 5, Instructions: 111COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE1207 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE9CAD Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 553synchronizationCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EF8129 Relevance: 5.8, Strings: 3, Instructions: 2032COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EF587C Relevance: 3.5, APIs: 2, Instructions: 540sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE9029 Relevance: 3.2, Strings: 2, Instructions: 665COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F028AE Relevance: 1.7, APIs: 1, Instructions: 201COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE83A5 Relevance: .7, Instructions: 665COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EF47C7 Relevance: 7.6, APIs: 5, Instructions: 92COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EF49FE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE1BBA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F03841 Relevance: 4.6, APIs: 3, Instructions: 111COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F01729 Relevance: 3.8, APIs: 3, Instructions: 47COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EF65BC Relevance: 3.3, APIs: 2, Instructions: 316sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE7341 Relevance: 3.1, APIs: 2, Instructions: 56memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE4BD9 Relevance: 3.0, APIs: 2, Instructions: 50fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE6C64 Relevance: 3.0, APIs: 2, Instructions: 44COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE80E7 Relevance: 3.0, APIs: 2, Instructions: 39pipeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE81EC Relevance: 2.5, APIs: 2, Instructions: 24COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE55BF Relevance: 1.6, APIs: 1, Instructions: 58COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE2052 Relevance: 1.4, APIs: 1, Instructions: 117memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EEA58B Relevance: 1.3, APIs: 1, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE1BE3 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EF4227 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 405filepipeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE15A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F01651 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EFCE7D Relevance: 1.7, Strings: 1, Instructions: 437COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EEE078 Relevance: .6, Instructions: 574COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EEAA69 Relevance: .2, Instructions: 182COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EFB610 Relevance: .2, Instructions: 156COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F014D0 Relevance: .1, Instructions: 121COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F05168 Relevance: .0, Instructions: 27COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE49D9 Relevance: 33.3, APIs: 1, Strings: 18, Instructions: 88libraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE3051 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 179libraryloaderwindowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE30B2 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 151libraryloaderwindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE7022 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 188memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EFA6B8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 172fileCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE31E6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 88libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EFADA8 Relevance: 9.1, APIs: 6, Instructions: 108COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE3F9A Relevance: 7.6, APIs: 5, Instructions: 83fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F0112D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F03527 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE1006 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE42C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F025A4 Relevance: 5.1, APIs: 4, Instructions: 67COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EE14B1 Relevance: 5.1, APIs: 4, Instructions: 63stringCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|