Windows Analysis Report
gfehgfwveg.exe

AI detected suspicious sample

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.9% probability

Machine Learning detection for sample

Source: gfehgfwveg.exe

Joe Sandbox ML: detected

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49800 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49803 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49804 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49834 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49810 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49830 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49841 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49859 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49861 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49837 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49858 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49886 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49890 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49896 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49860 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49899 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49912 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49918 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49921 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49927 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49955 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49952 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49957 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49956 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49983 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49988 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49991 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49998 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50011 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50018 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50023 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50028 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50044 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50045 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50046 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50047 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50053 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50052 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50054 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50055 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50060 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50062 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50063 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50061 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50069 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50070 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50071 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50076 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50077 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50068 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50079 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50086 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50078 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50085 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50084 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50087 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50092 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50093 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50095 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50100 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50101 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50102 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50103 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50094 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50109 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50110 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50111 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50108 -> 34.34.145.103:443

Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS

Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103

Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: gfehgfwveg.exe, 00000000.00000003.2097989940.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2099321079.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: gfehgfwveg.exe, 00000000.00000003.2097140713.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: gfehgfwveg.exe, 00000000.00000003.2097140713.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

E-Banking Fraud

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Process Stats: CPU usage > 49%

Source: gfehgfwveg.exe

Static PE information: Number of sections : 11 > 10

Source: gfehgfwveg.exe, 00000000.00000003.2097989940.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000003.2099321079.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs gfehgfwveg.exe

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal92.troj.evad.winEXE@6/0@0/4

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5512:120:WilError_03

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: gfehgfwveg.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\gfehgfwveg.exe "C:\Users\user\Desktop\gfehgfwveg.exe"
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

May use the Tor software to hide its network traffic

Source: gfehgfwveg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gfehgfwveg.exe

Static file information: File size 4276224 > 1048576

Source: gfehgfwveg.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3ec600

Source: gfehgfwveg.exe

Static PE information: section name: .didata

Hooking and other Techniques for Hiding and Protection

Source: gfehgfwveg.exe, 00000000.00000003.2093905422.000000007E870000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Window / User API: threadDelayed 9960

Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000003.2100996287.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}l
Source: gfehgfwveg.exe, 00000000.00000003.2100996287.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\Y

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Found potential dummy code loops (likely to delay analysis)

Anti Debugging

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Process Stats: CPU usage > 42% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000003.2093905422.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: gfehgfwveg.exe, 00000000.00000003.2093905422.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Source: Yara match

File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	142 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
gfehgfwveg.exe	55%	ReversingLabs	Win32.Trojan.Danabot
gfehgfwveg.exe	100%	Avira	TR/ATRAPS.Gen
gfehgfwveg.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
http://html4/loose.dtd	gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.htmlRAND	gfehgfwveg.exe, 00000000.00000003.2097140713.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.css	gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/V	gfehgfwveg.exe, 00000000.00000003.2097989940.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2099321079.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.jpg	gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.html	gfehgfwveg.exe, 00000000.00000003.2097140713.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.195.45.98	unknown	United States	15169	GOOGLEUS	false
34.83.67.185	unknown	United States	15169	GOOGLEUS	false
34.34.145.103	unknown	United States	2686	ATGS-MMD-ASUS	true
34.169.99.17	unknown	United States	2686	ATGS-MMD-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580519
Start date and time:	2024-12-24 20:48:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gfehgfwveg.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@6/0@0/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: gfehgfwveg.exe

Simulations

Behavior and APIs

Time	Type	Description
14:49:00	API Interceptor	1x Sleep call for process: WMIC.exe modified
14:49:38	API Interceptor	11300372x Sleep call for process: gfehgfwveg.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	loligang.spc.elf	Get hash	malicious	Mirai	Browse	32.27.52.57
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	57.54.62.198
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	34.133.187.81
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	48.209.59.149
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	57.210.138.22
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	48.123.52.22
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	48.168.135.209
	armv7l.elf	Get hash	malicious	Mirai	Browse	34.17.113.87
	armv4l.elf	Get hash	malicious	Mirai	Browse	48.252.70.235
	armv5l.elf	Get hash	malicious	Mirai	Browse	48.240.60.37
ATGS-MMD-ASUS	loligang.spc.elf	Get hash	malicious	Mirai	Browse	32.27.52.57
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	57.54.62.198
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	34.133.187.81
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	48.209.59.149
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	57.210.138.22
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	48.123.52.22
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	48.168.135.209
	armv7l.elf	Get hash	malicious	Mirai	Browse	34.17.113.87
	armv4l.elf	Get hash	malicious	Mirai	Browse	48.252.70.235
	armv5l.elf	Get hash	malicious	Mirai	Browse	48.240.60.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.797143844212164
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	gfehgfwveg.exe
File size:	4'276'224 bytes
MD5:	43ec2649e1b173b6e8b3800e18cceeb4
SHA1:	e864b2d11a7c9c7497b22af930b31db1e2061244
SHA256:	4e906e880e35e4bc0de7e9375fc0feb5757374ca0bb628dff6366174536d6183
SHA512:	83ec8f330986807a7b927c47f6becf26fd926bbfac096b9160c36e30c3a30fd7e05ebdef2556dc1aab3c61bf01e1f633ab6e9535440d95bdfcfa418bf139f086
SSDEEP:	98304:nNLjlVuxN0obg4MLp6bsYOYQyLmZwPoyAkDnZ:n5lVuxNvglisVyLZPJDnZ
TLSH:	9F16F122F64C667ED4AF0E395877B594583F77A1B99ADC1B47E0098CCE35880363A24F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x7eee00
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x676AEC85 [Tue Dec 24 17:16:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	29e05b1fea10173c5bcc5ba6150988ec

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFE4h
xor eax, eax
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-18h], eax
mov eax, 007E9C9Ch
call 00007FBA6082083Dh
xor eax, eax
push ebp
push 007EEF1Dh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
call 00007FBA60BF937Ah
cmp eax, 000000FAh
jnl 00007FBA60BFF232h
call 00007FBA60BF93C6h
cmp eax, 78h
jnl 00007FBA60BFF224h
mov dword ptr [007FCFA0h], 00000001h
mov dword ptr [007FCF9Ch], 001DBCD7h
mov eax, dword ptr [007FCF9Ch]
mov dword ptr [007FCFA4h], eax
mov eax, dword ptr [007FCF9Ch]
test eax, eax
jl 00007FBA60BFF18Eh
inc eax
mov dword ptr [ebp-14h], eax
mov dword ptr [007FCF98h], 00000000h
inc dword ptr [007FCFA0h]
dec dword ptr [007FCFA4h]
push 00000000h
call 00007FBA60838839h
inc dword ptr [007FCF98h]
dec dword ptr [ebp-14h]
jne 00007FBA60BFF144h
cmp dword ptr [007FCFA4h], FFFFFFFFh
jne 00007FBA60BFF1C4h
lea edx, dword ptr [ebp-18h]
mov ax, 0063h
call 00007FBA60BF96A1h
mov eax, dword ptr [ebp-18h]
mov edx, 007EEF38h
call 00007FBA6081AD6Ch
je 00007FBA60BFF1A9h
call 00007FBA60BF98E1h
cmp eax, 0Ah
jbe 00007FBA60BFF19Fh
call 00007FBA60C098F7h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x400000	0x96	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3fd000	0x16c6	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x41d000	0x3600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x403000	0x191c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x402000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3fd4cc	0x364	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3ff000	0x278	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ec544	0x3ec600	d7aefb5d6e6de984e994dc7c45754b87	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x3ee000	0xf50	0x1000	aada5a4a7410fe967643c3d004a17c32	False	0.558349609375	data	6.162614752272672	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3ef000	0x7d68	0x7e00	72410db874b473bfd55dbb3785831cd6	False	0.5638950892857143	data	6.356179507417859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x3f7000	0x5fac	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3fd000	0x16c6	0x1800	f83dfbc7a8d8169726b5b3aba8787951	False	0.3240559895833333	data	4.895786587173563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x3ff000	0x278	0x400	7a0cace727c21d6b42ac476919254aa3	False	0.26953125	firmware 100 v0 (revision 2733719296) X\361? , version 54304.16640.10270 (region 2297446144), 0 bytes or less, UNKNOWN1 0x88f03f00, at 0 0 bytes , at 0 0 bytes , at 0x60524000 3629203456 bytes	2.7239518130953684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x400000	0x96	0x200	09704f1006f905baccdf053cd9af9689	False	0.248046875	data	1.738190464085354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x401000	0x20	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x402000	0x5c	0x200	610e9cb9d596ddf3f8481c9e9885e5fe	False	0.1875	data	1.343433641850296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x403000	0x191c0	0x19200	2d0a440ed47b481783a33f1e4c0e5378	False	0.5856071206467661	data	6.706934385109459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x41d000	0x3600	0x3600	d77787dd189e78a674c960d21fa4face	False	0.2931857638888889	data	3.7312727777990213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_STRING	0x41d368	0x4e0	data	0.3333333333333333
RT_STRING	0x41d848	0x310	data	0.35331632653061223
RT_STRING	0x41db58	0x330	data	0.39215686274509803
RT_STRING	0x41de88	0x4c4	data	0.3983606557377049
RT_STRING	0x41e34c	0x4ac	data	0.32274247491638797
RT_STRING	0x41e7f8	0x3b4	data	0.3628691983122363
RT_STRING	0x41ebac	0x440	data	0.38235294117647056
RT_STRING	0x41efec	0x21c	data	0.40555555555555556
RT_STRING	0x41f208	0xbc	data	0.6542553191489362
RT_STRING	0x41f2c4	0x100	data	0.62890625
RT_STRING	0x41f3c4	0x338	data	0.4223300970873786
RT_STRING	0x41f6fc	0x478	data	0.29895104895104896
RT_STRING	0x41fb74	0x354	data	0.4107981220657277
RT_STRING	0x41fec8	0x2b8	data	0.4367816091954023
RT_RCDATA	0x420180	0x10	data	1.5
RT_RCDATA	0x420190	0x3ec	data	0.6125498007968128

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	CreateWindowExW, UpdateWindow, TranslateMessage, SystemParametersInfoW, ShowWindow, RegisterClassW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, GetMessageW, EndPaint, DispatchMessageW, DefWindowProcW, CharUpperBuffW, CharUpperW, CharLowerBuffW, BeginPaint
gdi32.dll	SetBkColor, Rectangle
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, UnmapViewOfFile, SwitchToThread, SuspendThread, Sleep, SetThreadPriority, SetLastError, SetFileTime, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReleaseSemaphore, ReadFile, RaiseException, QueryDosDeviceW, IsDebuggerPresent, MapViewOfFile, LocalFree, LoadLibraryA, LoadLibraryW, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVolumeInformationW, GetVersionExW, GetTimeZoneInformation, GetTickCount64, GetTickCount, GetThreadPriority, GetThreadLocale, GetSystemInfo, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLogicalDrives, GetLogicalDriveStringsW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesExW, GetFileAttributesW, GetExitCodeThread, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeLibrary, FormatMessageW, FlushInstructionCache, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitProcess, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateSemaphoreA, CreateProcessW, CreatePipe, CreateFileMappingW, CreateFileW, CreateEventA, CreateEventW, CreateDirectoryW, CompareStringW, CloseHandle
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
msvcrt.dll	memset, memmove, memcpy
msvcrt.dll	_beginthreadex
winmm.dll	waveOutGetVolume

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x7824b4
__dbk_fcall_wrapper	2	0x4103c4
dbkFCallWrapperAddr	1	0x7fa630

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T20:49:57.437474+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49800	34.34.145.103	443	TCP
2024-12-24T20:49:58.536827+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49803	34.169.99.17	443	TCP
2024-12-24T20:49:59.665387+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49804	34.83.67.185	443	TCP
2024-12-24T20:50:00.749409+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49810	35.195.45.98	443	TCP
2024-12-24T20:50:08.252668+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49830	34.34.145.103	443	TCP
2024-12-24T20:50:09.525522+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49834	34.169.99.17	443	TCP
2024-12-24T20:50:10.603924+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49837	34.83.67.185	443	TCP
2024-12-24T20:50:11.730286+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49841	35.195.45.98	443	TCP
2024-12-24T20:50:17.308243+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49858	34.34.145.103	443	TCP
2024-12-24T20:50:17.396534+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49859	34.169.99.17	443	TCP
2024-12-24T20:50:17.477840+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49860	34.83.67.185	443	TCP
2024-12-24T20:50:17.587969+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49861	35.195.45.98	443	TCP
2024-12-24T20:50:26.896409+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49886	34.34.145.103	443	TCP
2024-12-24T20:50:28.769519+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49890	34.169.99.17	443	TCP
2024-12-24T20:50:30.353915+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49896	34.83.67.185	443	TCP
2024-12-24T20:50:32.149921+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49899	35.195.45.98	443	TCP
2024-12-24T20:50:35.421217+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49912	34.34.145.103	443	TCP
2024-12-24T20:50:37.234985+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49918	34.169.99.17	443	TCP
2024-12-24T20:50:38.845690+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49921	34.83.67.185	443	TCP
2024-12-24T20:50:40.365380+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49927	35.195.45.98	443	TCP
2024-12-24T20:50:49.840728+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49952	34.34.145.103	443	TCP
2024-12-24T20:50:49.950089+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49955	34.169.99.17	443	TCP
2024-12-24T20:50:50.101927+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49956	34.83.67.185	443	TCP
2024-12-24T20:50:50.286070+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49957	35.195.45.98	443	TCP
2024-12-24T20:51:01.351951+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49983	34.34.145.103	443	TCP
2024-12-24T20:51:03.495105+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49988	34.169.99.17	443	TCP
2024-12-24T20:51:04.974891+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49991	34.83.67.185	443	TCP
2024-12-24T20:51:07.388822+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49998	35.195.45.98	443	TCP
2024-12-24T20:51:10.773407+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50011	34.34.145.103	443	TCP
2024-12-24T20:51:13.480850+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50018	34.169.99.17	443	TCP
2024-12-24T20:51:16.231070+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50023	34.83.67.185	443	TCP
2024-12-24T20:51:17.843648+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50028	35.195.45.98	443	TCP
2024-12-24T20:51:30.006700+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50044	34.34.145.103	443	TCP
2024-12-24T20:51:30.084499+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50045	34.169.99.17	443	TCP
2024-12-24T20:51:30.147283+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50046	34.83.67.185	443	TCP
2024-12-24T20:51:30.274087+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50047	35.195.45.98	443	TCP
2024-12-24T20:51:42.384115+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50052	34.34.145.103	443	TCP
2024-12-24T20:51:45.127272+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50053	34.169.99.17	443	TCP
2024-12-24T20:51:47.363251+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50054	34.83.67.185	443	TCP
2024-12-24T20:51:49.543295+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50055	35.195.45.98	443	TCP
2024-12-24T20:51:53.492437+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50060	34.34.145.103	443	TCP
2024-12-24T20:51:56.140020+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50061	34.169.99.17	443	TCP
2024-12-24T20:51:58.720024+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50062	34.83.67.185	443	TCP
2024-12-24T20:52:00.858456+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50063	35.195.45.98	443	TCP
2024-12-24T20:52:14.200139+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50068	34.34.145.103	443	TCP
2024-12-24T20:52:14.310341+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50069	34.169.99.17	443	TCP
2024-12-24T20:52:14.394340+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50070	34.83.67.185	443	TCP
2024-12-24T20:52:14.471379+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50071	35.195.45.98	443	TCP
2024-12-24T20:52:26.921628+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50076	34.34.145.103	443	TCP
2024-12-24T20:52:29.172493+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50077	34.169.99.17	443	TCP
2024-12-24T20:52:31.469787+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50078	34.83.67.185	443	TCP
2024-12-24T20:52:33.819170+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50079	35.195.45.98	443	TCP
2024-12-24T20:52:39.115081+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50084	34.34.145.103	443	TCP
2024-12-24T20:52:41.407909+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50085	34.169.99.17	443	TCP
2024-12-24T20:52:43.802047+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50086	34.83.67.185	443	TCP
2024-12-24T20:52:45.270054+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50087	35.195.45.98	443	TCP
2024-12-24T20:52:50.668751+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50092	34.34.145.103	443	TCP
2024-12-24T20:52:50.725016+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50093	34.169.99.17	443	TCP
2024-12-24T20:52:50.800171+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50094	34.83.67.185	443	TCP
2024-12-24T20:52:50.851757+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50095	35.195.45.98	443	TCP
2024-12-24T20:52:58.374899+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50100	34.34.145.103	443	TCP
2024-12-24T20:52:59.434077+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50101	34.169.99.17	443	TCP
2024-12-24T20:53:00.520563+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50102	34.83.67.185	443	TCP
2024-12-24T20:53:01.628273+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50103	35.195.45.98	443	TCP
2024-12-24T20:53:03.916416+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50108	34.34.145.103	443	TCP
2024-12-24T20:53:04.997393+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50109	34.169.99.17	443	TCP
2024-12-24T20:53:06.099941+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50110	34.83.67.185	443	TCP
2024-12-24T20:53:07.154378+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50111	35.195.45.98	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 20:49:05.113316059 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:05.113344908 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:05.113426924 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:05.197771072 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:05.197782040 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:05.197958946 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:05.197971106 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:05.197979927 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:06.309802055 CET	49705	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:49:06.309894085 CET	443	49705	34.169.99.17	192.168.2.5
Dec 24, 2024 20:49:06.309999943 CET	49705	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:49:07.401005983 CET	49705	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:49:07.401032925 CET	443	49705	34.169.99.17	192.168.2.5
Dec 24, 2024 20:49:07.401132107 CET	443	49705	34.169.99.17	192.168.2.5
Dec 24, 2024 20:49:08.425440073 CET	49706	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:49:08.425487995 CET	443	49706	34.83.67.185	192.168.2.5
Dec 24, 2024 20:49:08.425576925 CET	49706	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:49:08.518367052 CET	49706	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:49:08.518392086 CET	443	49706	34.83.67.185	192.168.2.5
Dec 24, 2024 20:49:08.518443108 CET	443	49706	34.83.67.185	192.168.2.5
Dec 24, 2024 20:49:09.569377899 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:49:09.569420099 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:49:09.569495916 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:49:09.665699005 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:49:09.665715933 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:49:09.665771008 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:49:09.665776014 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:49:09.665817976 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:49:57.376652002 CET	49800	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:57.376688957 CET	443	49800	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:57.376750946 CET	49800	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:57.437474012 CET	49800	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:57.437485933 CET	443	49800	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:57.437540054 CET	49800	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:49:57.437546015 CET	443	49800	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:57.437575102 CET	443	49800	34.34.145.103	192.168.2.5
Dec 24, 2024 20:49:58.455090046 CET	49803	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:49:58.455152988 CET	443	49803	34.169.99.17	192.168.2.5
Dec 24, 2024 20:49:58.455358982 CET	49803	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:49:58.536827087 CET	49803	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:49:58.536864042 CET	443	49803	34.169.99.17	192.168.2.5
Dec 24, 2024 20:49:58.536921978 CET	443	49803	34.169.99.17	192.168.2.5
Dec 24, 2024 20:49:58.536931038 CET	49803	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:49:58.536948919 CET	443	49803	34.169.99.17	192.168.2.5
Dec 24, 2024 20:49:59.565937042 CET	49804	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:49:59.565995932 CET	443	49804	34.83.67.185	192.168.2.5
Dec 24, 2024 20:49:59.566112995 CET	49804	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:49:59.665386915 CET	49804	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:49:59.665415049 CET	443	49804	34.83.67.185	192.168.2.5
Dec 24, 2024 20:49:59.665491104 CET	49804	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:49:59.665498018 CET	443	49804	34.83.67.185	192.168.2.5
Dec 24, 2024 20:49:59.665505886 CET	443	49804	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:00.689996958 CET	49810	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:00.690098047 CET	443	49810	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:00.690202951 CET	49810	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:00.749408960 CET	49810	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:00.749452114 CET	443	49810	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:00.749535084 CET	443	49810	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:00.749537945 CET	49810	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:00.749567032 CET	443	49810	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:00.757499933 CET	49811	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:00.757556915 CET	443	49811	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:00.757626057 CET	49811	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:00.848030090 CET	49811	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:00.848052979 CET	443	49811	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:00.848088026 CET	49811	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:00.848094940 CET	443	49811	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:00.848119974 CET	443	49811	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:00.859141111 CET	49812	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:00.859231949 CET	443	49812	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:00.859344959 CET	49812	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:00.922425985 CET	49812	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:00.922468901 CET	443	49812	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:00.922538042 CET	443	49812	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:00.922580004 CET	49812	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:00.922601938 CET	443	49812	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:00.930737972 CET	49813	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:00.930802107 CET	443	49813	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:00.930895090 CET	49813	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:01.005402088 CET	49813	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:01.005455971 CET	443	49813	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:01.005485058 CET	49813	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:01.005496025 CET	443	49813	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:01.005517006 CET	443	49813	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:01.012564898 CET	49814	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:01.012610912 CET	443	49814	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:01.012700081 CET	49814	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:01.080221891 CET	49814	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:01.080238104 CET	443	49814	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:01.080291033 CET	443	49814	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:01.080302954 CET	49814	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:01.080317020 CET	443	49814	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:08.189711094 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:08.189764977 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:08.189846039 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:08.252667904 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:08.252708912 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:08.252751112 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:08.252769947 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:08.252791882 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:09.425524950 CET	49834	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:09.425612926 CET	443	49834	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:09.425693035 CET	49834	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:09.525521994 CET	49834	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:09.525583029 CET	443	49834	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:09.525629997 CET	443	49834	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:09.525651932 CET	49834	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:09.525674105 CET	443	49834	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:10.549550056 CET	49837	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:10.549617052 CET	443	49837	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:10.549776077 CET	49837	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:10.603924036 CET	49837	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:10.603940010 CET	443	49837	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:10.603996038 CET	443	49837	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:10.604034901 CET	49837	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:10.604053974 CET	443	49837	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:11.643038988 CET	49841	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:11.643084049 CET	443	49841	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:11.643196106 CET	49841	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:11.730285883 CET	49841	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:11.730361938 CET	443	49841	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:11.730422020 CET	443	49841	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:11.730443954 CET	49841	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:11.730477095 CET	443	49841	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:13.768246889 CET	49847	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:13.768273115 CET	443	49847	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:13.768343925 CET	49847	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:13.881983042 CET	49847	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:13.881983042 CET	49847	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:13.882002115 CET	443	49847	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:13.882008076 CET	443	49847	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:13.882050991 CET	443	49847	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:14.941849947 CET	49850	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:14.941891909 CET	443	49850	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:14.941975117 CET	49850	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:15.026504040 CET	49850	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:15.026521921 CET	443	49850	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:15.026563883 CET	443	49850	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:15.026571989 CET	49850	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:15.026587009 CET	443	49850	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:16.050988913 CET	49854	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:16.051053047 CET	443	49854	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:16.051304102 CET	49854	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:16.117863894 CET	49854	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:16.117908001 CET	443	49854	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:16.117954969 CET	443	49854	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:17.143454075 CET	49857	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:17.143479109 CET	443	49857	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:17.143551111 CET	49857	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:17.208451986 CET	49857	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:17.208465099 CET	443	49857	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:17.208476067 CET	49857	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:17.208481073 CET	443	49857	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:17.208622932 CET	443	49857	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:17.218420982 CET	49858	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:17.218497992 CET	443	49858	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:17.218569040 CET	49858	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:17.308243036 CET	49858	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:17.308279037 CET	443	49858	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:17.308316946 CET	443	49858	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:17.308360100 CET	49858	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:17.308379889 CET	443	49858	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:17.318921089 CET	49859	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:17.319005966 CET	443	49859	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:17.319117069 CET	49859	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:17.396533966 CET	49859	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:17.396600962 CET	443	49859	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:17.396632910 CET	443	49859	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:17.396677017 CET	49859	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:17.396707058 CET	443	49859	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:17.406979084 CET	49860	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:17.407047987 CET	443	49860	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:17.407121897 CET	49860	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:17.477839947 CET	49860	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:17.477886915 CET	443	49860	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:17.477910042 CET	443	49860	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:17.477937937 CET	49860	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:17.477957010 CET	443	49860	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:17.488410950 CET	49861	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:17.488440990 CET	443	49861	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:17.488501072 CET	49861	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:17.587969065 CET	49861	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:17.587989092 CET	443	49861	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:17.588027954 CET	443	49861	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:19.611884117 CET	49867	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:19.611923933 CET	443	49867	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:19.611994028 CET	49867	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:19.680938959 CET	49867	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:19.680958986 CET	443	49867	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:19.681004047 CET	49867	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:19.681010962 CET	443	49867	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:19.681047916 CET	443	49867	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:21.377067089 CET	49871	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:21.377094984 CET	443	49871	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:21.377180099 CET	49871	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:21.429577112 CET	49871	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:21.429590940 CET	443	49871	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:21.429630995 CET	443	49871	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:21.429639101 CET	49871	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:21.429646969 CET	443	49871	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:22.709908009 CET	49877	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:22.709969044 CET	443	49877	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:22.710177898 CET	49877	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:22.780937910 CET	49877	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:22.780937910 CET	49877	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:22.781007051 CET	443	49877	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:22.781047106 CET	443	49877	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:22.781080961 CET	443	49877	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:24.085915089 CET	49880	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:24.085942984 CET	443	49880	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:24.086205006 CET	49880	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:24.264812946 CET	49880	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:24.264828920 CET	443	49880	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:24.264864922 CET	443	49880	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:26.798753977 CET	49886	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:26.798809052 CET	443	49886	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:26.799144983 CET	49886	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:26.896409035 CET	49886	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:26.896441936 CET	443	49886	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:26.896497011 CET	49886	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:26.896497011 CET	443	49886	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:26.896512985 CET	443	49886	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:28.321902990 CET	49890	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:28.321954966 CET	443	49890	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:28.325992107 CET	49890	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:28.769519091 CET	49890	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:28.769548893 CET	443	49890	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:28.769601107 CET	443	49890	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:30.149914980 CET	49896	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:30.149985075 CET	443	49896	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:30.150157928 CET	49896	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:30.353914976 CET	49896	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:30.353964090 CET	443	49896	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:30.354012012 CET	443	49896	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:31.940151930 CET	49899	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:31.940228939 CET	443	49899	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:31.940421104 CET	49899	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:32.149920940 CET	49899	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:32.149950027 CET	443	49899	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:32.149987936 CET	443	49899	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:32.949562073 CET	49903	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:32.949628115 CET	443	49903	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:32.949781895 CET	49903	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:33.085118055 CET	49903	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:33.085144997 CET	443	49903	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:33.085177898 CET	443	49903	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:33.085211039 CET	49903	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:33.085226059 CET	443	49903	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:33.095480919 CET	49906	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:33.095556974 CET	443	49906	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:33.095642090 CET	49906	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:33.165271997 CET	49906	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:33.165313005 CET	443	49906	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:33.165344000 CET	443	49906	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:33.165376902 CET	49906	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:33.165414095 CET	443	49906	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:33.174943924 CET	49907	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:33.174989939 CET	443	49907	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:33.175046921 CET	49907	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:33.237133026 CET	49907	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:33.237158060 CET	443	49907	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:33.237193108 CET	443	49907	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:33.239068031 CET	49908	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:33.239115000 CET	443	49908	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:33.239242077 CET	49908	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:33.309129000 CET	49908	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:33.309161901 CET	443	49908	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:33.309195042 CET	443	49908	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:35.349474907 CET	49912	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:35.349533081 CET	443	49912	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:35.349601030 CET	49912	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:35.421216965 CET	49912	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:35.421233892 CET	443	49912	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:35.421273947 CET	443	49912	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:35.421274900 CET	49912	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:35.421284914 CET	443	49912	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:37.096441031 CET	49918	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:37.096493959 CET	443	49918	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:37.096576929 CET	49918	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:37.234985113 CET	49918	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:37.235001087 CET	443	49918	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:37.235042095 CET	443	49918	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:37.235047102 CET	49918	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:37.235055923 CET	443	49918	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:38.631104946 CET	49921	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:38.631162882 CET	443	49921	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:38.633985996 CET	49921	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:38.845690012 CET	49921	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:38.845705986 CET	443	49921	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:38.845740080 CET	443	49921	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:38.845750093 CET	49921	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:38.845758915 CET	443	49921	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:40.301912069 CET	49927	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:40.301968098 CET	443	49927	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:40.302505016 CET	49927	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:40.365380049 CET	49927	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:40.365396976 CET	443	49927	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:40.365442038 CET	443	49927	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:40.365462065 CET	49927	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:40.365473032 CET	443	49927	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:43.064954996 CET	49933	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:43.064999104 CET	443	49933	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:43.065062046 CET	49933	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:43.130433083 CET	49933	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:43.130445004 CET	443	49933	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:43.130487919 CET	443	49933	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:43.130510092 CET	49933	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:43.130517006 CET	443	49933	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:45.048758984 CET	49939	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:45.048839092 CET	443	49939	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:45.048928022 CET	49939	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:45.109795094 CET	49939	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:45.109853029 CET	443	49939	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:45.109885931 CET	443	49939	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:46.741918087 CET	49945	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:46.741940975 CET	443	49945	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:46.742058039 CET	49945	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:46.807586908 CET	49945	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:46.807586908 CET	49945	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:46.807600021 CET	443	49945	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:46.807609081 CET	443	49945	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:46.807636023 CET	443	49945	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:48.417948961 CET	49949	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:48.418030024 CET	443	49949	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:48.422019005 CET	49949	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:48.476212978 CET	49949	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:48.476252079 CET	443	49949	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:48.476305962 CET	443	49949	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:49.581162930 CET	49952	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:49.581185102 CET	443	49952	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:49.581269026 CET	49952	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:49.840728045 CET	49952	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:49.840740919 CET	443	49952	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:49.840776920 CET	443	49952	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:49.840832949 CET	49952	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:49.840842962 CET	443	49952	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:49.854979038 CET	49955	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:49.855016947 CET	443	49955	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:49.855160952 CET	49955	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:49.950088978 CET	49955	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:49.950120926 CET	443	49955	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:49.950149059 CET	443	49955	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:49.950186014 CET	49955	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:49.950201035 CET	443	49955	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:49.963987112 CET	49956	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:49.964086056 CET	443	49956	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:49.964350939 CET	49956	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:50.101927042 CET	49956	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:50.101967096 CET	443	49956	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:50.101996899 CET	443	49956	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:50.129928112 CET	49957	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:50.129957914 CET	443	49957	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:50.130157948 CET	49957	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:50.286070108 CET	49957	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:50.286106110 CET	443	49957	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:50.286134958 CET	443	49957	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:52.330362082 CET	49962	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:52.330379963 CET	443	49962	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:52.330558062 CET	49962	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:52.450418949 CET	49962	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:52.450438023 CET	443	49962	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:52.450453997 CET	49962	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:50:52.450459957 CET	443	49962	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:52.450483084 CET	443	49962	34.34.145.103	192.168.2.5
Dec 24, 2024 20:50:53.971259117 CET	49965	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:53.971302032 CET	443	49965	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:53.971399069 CET	49965	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:54.028805971 CET	49965	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:54.028825998 CET	443	49965	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:54.028861046 CET	443	49965	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:54.028863907 CET	49965	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:50:54.028875113 CET	443	49965	34.169.99.17	192.168.2.5
Dec 24, 2024 20:50:56.380928040 CET	49970	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:56.380942106 CET	443	49970	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:56.381025076 CET	49970	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:56.533667088 CET	49970	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:56.533679008 CET	443	49970	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:56.533719063 CET	443	49970	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:56.533742905 CET	49970	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:50:56.533749104 CET	443	49970	34.83.67.185	192.168.2.5
Dec 24, 2024 20:50:58.549103975 CET	49975	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:58.549129963 CET	443	49975	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:58.549199104 CET	49975	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:58.597234011 CET	49975	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:58.597245932 CET	443	49975	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:58.597321033 CET	443	49975	35.195.45.98	192.168.2.5
Dec 24, 2024 20:50:58.597351074 CET	49975	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:50:58.597358942 CET	443	49975	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:01.300910950 CET	49983	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:01.300964117 CET	443	49983	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:01.301054001 CET	49983	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:01.351950884 CET	49983	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:01.351968050 CET	443	49983	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:01.352011919 CET	443	49983	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:01.352039099 CET	49983	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:01.352047920 CET	443	49983	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:03.236548901 CET	49988	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:03.236591101 CET	443	49988	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:03.236676931 CET	49988	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:03.495105028 CET	49988	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:03.495126963 CET	443	49988	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:03.495165110 CET	443	49988	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:04.912034035 CET	49991	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:04.912060022 CET	443	49991	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:04.916066885 CET	49991	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:04.974890947 CET	49991	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:04.974903107 CET	443	49991	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:04.974932909 CET	443	49991	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:07.317938089 CET	49998	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:07.317954063 CET	443	49998	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:07.318080902 CET	49998	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:07.388822079 CET	49998	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:07.388844013 CET	443	49998	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:07.388870955 CET	443	49998	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:08.247093916 CET	50002	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:08.247138023 CET	443	50002	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:08.247227907 CET	50002	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:08.411003113 CET	50002	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:08.411041021 CET	443	50002	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:08.411077023 CET	443	50002	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:08.411102057 CET	50002	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:08.411124945 CET	443	50002	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:08.423268080 CET	50003	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:08.423293114 CET	443	50003	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:08.423362017 CET	50003	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:08.512926102 CET	50003	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:08.512939930 CET	443	50003	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:08.512963057 CET	443	50003	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:08.512980938 CET	50003	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:08.512991905 CET	443	50003	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:08.526294947 CET	50004	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:08.526314974 CET	443	50004	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:08.526372910 CET	50004	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:08.596965075 CET	50004	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:08.596977949 CET	443	50004	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:08.596997023 CET	50004	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:08.597001076 CET	443	50004	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:08.597012043 CET	443	50004	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:08.608191013 CET	50006	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:08.608256102 CET	443	50006	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:08.608318090 CET	50006	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:08.678807974 CET	50006	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:08.678853989 CET	443	50006	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:08.678881884 CET	50006	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:08.678883076 CET	443	50006	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:08.678901911 CET	443	50006	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:10.720818043 CET	50011	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:10.720868111 CET	443	50011	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:10.720931053 CET	50011	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:10.773406982 CET	50011	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:10.773432970 CET	443	50011	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:10.773472071 CET	443	50011	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:10.773474932 CET	50011	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:10.773483992 CET	443	50011	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:13.002011061 CET	50018	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:13.002059937 CET	443	50018	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:13.002202034 CET	50018	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:13.480849981 CET	50018	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:13.480874062 CET	443	50018	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:13.480911016 CET	443	50018	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:16.033751011 CET	50023	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:16.033791065 CET	443	50023	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:16.033852100 CET	50023	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:16.231070042 CET	50023	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:16.231106043 CET	443	50023	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:16.231139898 CET	443	50023	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:17.783122063 CET	50028	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:17.783149004 CET	443	50028	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:17.783276081 CET	50028	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:17.843647957 CET	50028	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:17.843668938 CET	443	50028	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:17.843715906 CET	443	50028	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:20.561896086 CET	50034	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:20.561947107 CET	443	50034	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:20.562014103 CET	50034	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:20.667224884 CET	50034	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:20.667258978 CET	443	50034	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:20.667273045 CET	50034	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:20.667282104 CET	443	50034	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:20.667299986 CET	443	50034	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:22.982012987 CET	50040	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:22.982038021 CET	443	50040	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:22.982151031 CET	50040	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:23.045958042 CET	50040	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:23.045969963 CET	443	50040	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:23.046005011 CET	443	50040	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:23.046037912 CET	50040	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:23.046046019 CET	443	50040	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:25.788566113 CET	50042	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:25.788626909 CET	443	50042	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:25.792948008 CET	50042	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:25.847791910 CET	50042	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:25.847829103 CET	443	50042	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:25.847918987 CET	443	50042	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:25.847949028 CET	50042	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:25.847970009 CET	443	50042	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:28.049335003 CET	50043	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:28.049422026 CET	443	50043	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:28.049505949 CET	50043	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:28.110039949 CET	50043	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:28.110088110 CET	443	50043	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:28.110117912 CET	50043	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:28.110133886 CET	443	50043	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:28.110240936 CET	443	50043	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:29.464008093 CET	50044	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:29.464041948 CET	443	50044	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:29.464406967 CET	50044	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:30.006700039 CET	50044	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:30.006725073 CET	443	50044	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:30.006769896 CET	50044	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:30.006808996 CET	443	50044	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:30.006908894 CET	443	50044	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:30.020215034 CET	50045	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:30.020313025 CET	443	50045	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:30.020378113 CET	50045	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:30.084498882 CET	50045	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:30.084541082 CET	443	50045	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:30.084588051 CET	443	50045	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:30.084589958 CET	50045	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:30.084609985 CET	443	50045	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:30.095045090 CET	50046	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:30.095093012 CET	443	50046	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:30.095144987 CET	50046	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:30.147283077 CET	50046	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:30.147301912 CET	443	50046	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:30.147346973 CET	50046	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:30.147352934 CET	443	50046	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:30.147383928 CET	443	50046	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:30.160613060 CET	50047	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:30.160624027 CET	443	50047	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:30.160681963 CET	50047	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:30.274086952 CET	50047	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:30.274112940 CET	443	50047	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:30.274158955 CET	50047	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:30.274163961 CET	443	50047	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:30.274184942 CET	443	50047	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:32.315785885 CET	50048	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:32.315859079 CET	443	50048	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:32.315927982 CET	50048	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:32.421336889 CET	50048	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:32.421359062 CET	443	50048	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:32.421406984 CET	50048	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:32.421437025 CET	443	50048	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:32.421528101 CET	443	50048	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:34.299729109 CET	50049	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:34.299767017 CET	443	50049	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:34.299829960 CET	50049	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:34.383049965 CET	50049	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:34.383076906 CET	443	50049	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:34.383126020 CET	50049	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:34.383136034 CET	443	50049	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:34.383188009 CET	443	50049	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:36.665158033 CET	50050	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:36.665236950 CET	443	50050	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:36.665354967 CET	50050	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:36.857845068 CET	50050	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:36.857896090 CET	443	50050	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:36.857927084 CET	50050	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:36.857943058 CET	443	50050	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:36.857995987 CET	443	50050	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:39.002135038 CET	50051	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:39.002228022 CET	443	50051	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:39.006097078 CET	50051	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:39.083498955 CET	50051	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:39.083544970 CET	443	50051	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:39.083612919 CET	443	50051	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:42.298280954 CET	50052	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:42.298369884 CET	443	50052	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:42.298455000 CET	50052	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:42.384114981 CET	50052	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:42.384166002 CET	443	50052	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:42.384224892 CET	50052	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:42.384227991 CET	443	50052	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:42.384248018 CET	443	50052	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:45.017352104 CET	50053	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:45.017460108 CET	443	50053	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:45.017663002 CET	50053	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:45.127271891 CET	50053	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:45.127332926 CET	443	50053	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:45.127388954 CET	443	50053	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:45.127425909 CET	50053	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:45.127448082 CET	443	50053	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:46.985991955 CET	50054	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:46.986053944 CET	443	50054	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:46.986407995 CET	50054	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:47.363250971 CET	50054	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:47.363279104 CET	443	50054	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:47.363331079 CET	443	50054	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:49.472071886 CET	50055	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:49.472110987 CET	443	50055	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:49.476315975 CET	50055	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:49.543294907 CET	50055	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:49.543322086 CET	443	50055	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:49.543354988 CET	443	50055	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:50.293489933 CET	50056	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:50.293538094 CET	443	50056	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:50.293606997 CET	50056	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:50.681540012 CET	50056	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:50.681566954 CET	443	50056	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:50.681607008 CET	443	50056	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:50.681611061 CET	50056	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:50.681628942 CET	443	50056	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:50.696793079 CET	50057	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:50.696824074 CET	443	50057	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:50.696887970 CET	50057	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:50.782260895 CET	50057	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:50.782286882 CET	443	50057	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:50.782341957 CET	443	50057	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:50.800955057 CET	50058	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:50.801048994 CET	443	50058	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:50.801124096 CET	50058	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:51.162000895 CET	50058	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:51.162054062 CET	443	50058	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:51.162096977 CET	443	50058	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:51.201169014 CET	50059	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:51.201225996 CET	443	50059	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:51.201541901 CET	50059	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:51.310384035 CET	50059	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:51:51.310419083 CET	443	50059	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:51.310451984 CET	443	50059	35.195.45.98	192.168.2.5
Dec 24, 2024 20:51:53.345285892 CET	50060	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:53.345319986 CET	443	50060	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:53.346080065 CET	50060	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:53.492436886 CET	50060	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:51:53.492465019 CET	443	50060	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:53.492531061 CET	443	50060	34.34.145.103	192.168.2.5
Dec 24, 2024 20:51:55.800029993 CET	50061	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:55.800086021 CET	443	50061	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:55.800287962 CET	50061	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:56.140019894 CET	50061	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:56.140072107 CET	443	50061	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:56.140125990 CET	443	50061	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:56.140156031 CET	50061	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:51:56.140180111 CET	443	50061	34.169.99.17	192.168.2.5
Dec 24, 2024 20:51:58.488277912 CET	50062	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:58.488342047 CET	443	50062	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:58.488421917 CET	50062	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:58.720024109 CET	50062	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:58.720040083 CET	443	50062	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:58.720088959 CET	50062	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:51:58.720097065 CET	443	50062	34.83.67.185	192.168.2.5
Dec 24, 2024 20:51:58.720099926 CET	443	50062	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:00.689599991 CET	50063	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:00.689651966 CET	443	50063	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:00.689737082 CET	50063	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:00.858455896 CET	50063	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:00.858477116 CET	443	50063	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:00.858530998 CET	50063	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:00.858536005 CET	443	50063	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:00.858570099 CET	443	50063	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:04.267456055 CET	50064	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:04.267556906 CET	443	50064	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:04.267656088 CET	50064	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:04.327554941 CET	50064	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:04.327608109 CET	443	50064	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:04.327627897 CET	50064	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:04.327642918 CET	443	50064	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:04.327666998 CET	443	50064	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:07.137804985 CET	50065	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:07.137892008 CET	443	50065	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:07.138154030 CET	50065	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:07.216926098 CET	50065	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:07.216926098 CET	50065	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:07.216981888 CET	443	50065	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:07.217020035 CET	443	50065	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:07.217050076 CET	443	50065	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:09.362029076 CET	50066	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:09.362067938 CET	443	50066	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:09.362201929 CET	50066	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:09.780132055 CET	50066	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:09.780163050 CET	443	50066	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:09.780230999 CET	443	50066	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:09.780273914 CET	50066	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:09.780292034 CET	443	50066	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:11.861648083 CET	50067	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:11.861716032 CET	443	50067	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:11.861792088 CET	50067	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:11.937129974 CET	50067	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:11.937155008 CET	443	50067	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:11.937210083 CET	443	50067	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:14.099616051 CET	50068	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:14.099667072 CET	443	50068	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:14.099734068 CET	50068	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:14.200139046 CET	50068	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:14.200151920 CET	443	50068	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:14.200201035 CET	443	50068	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:14.200220108 CET	50068	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:14.200228930 CET	443	50068	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:14.210006952 CET	50069	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:14.210051060 CET	443	50069	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:14.210108995 CET	50069	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:14.310340881 CET	50069	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:14.310357094 CET	443	50069	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:14.310393095 CET	443	50069	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:14.310415030 CET	50069	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:14.310425043 CET	443	50069	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:14.321943045 CET	50070	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:14.321969986 CET	443	50070	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:14.322040081 CET	50070	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:14.394340038 CET	50070	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:14.394355059 CET	443	50070	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:14.394386053 CET	443	50070	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:14.397408009 CET	50071	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:14.397418976 CET	443	50071	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:14.397478104 CET	50071	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:14.471379042 CET	50071	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:14.471390009 CET	443	50071	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:14.471426010 CET	443	50071	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:14.471431971 CET	50071	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:14.471441984 CET	443	50071	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:16.501646042 CET	50072	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:16.501728058 CET	443	50072	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:16.501830101 CET	50072	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:16.564361095 CET	50072	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:16.564415932 CET	443	50072	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:16.564466953 CET	50072	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:16.564480066 CET	443	50072	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:16.564490080 CET	443	50072	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:18.564456940 CET	50073	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:18.564483881 CET	443	50073	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:18.564546108 CET	50073	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:18.620270967 CET	50073	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:18.620290995 CET	443	50073	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:18.620301008 CET	50073	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:18.620309114 CET	443	50073	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:18.620363951 CET	443	50073	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:21.079811096 CET	50074	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:21.079852104 CET	443	50074	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:21.079950094 CET	50074	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:21.135545969 CET	50074	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:21.135559082 CET	443	50074	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:21.135606050 CET	443	50074	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:21.135643959 CET	50074	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:21.135653019 CET	443	50074	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:23.238642931 CET	50075	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:23.238689899 CET	443	50075	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:23.238805056 CET	50075	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:23.520351887 CET	50075	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:23.520385981 CET	443	50075	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:23.520450115 CET	443	50075	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:23.520473957 CET	50075	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:23.520490885 CET	443	50075	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:26.689562082 CET	50076	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:26.689626932 CET	443	50076	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:26.689687967 CET	50076	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:26.921627998 CET	50076	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:26.921658993 CET	443	50076	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:26.921700954 CET	50076	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:26.921705961 CET	443	50076	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:26.921725988 CET	443	50076	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:29.114048958 CET	50077	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:29.114094973 CET	443	50077	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:29.122035027 CET	50077	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:29.172492981 CET	50077	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:29.172506094 CET	443	50077	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:29.172553062 CET	443	50077	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:31.408674955 CET	50078	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:31.408768892 CET	443	50078	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:31.408916950 CET	50078	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:31.469786882 CET	50078	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:31.469831944 CET	443	50078	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:31.469886065 CET	443	50078	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:33.736259937 CET	50079	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:33.736362934 CET	443	50079	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:33.740648985 CET	50079	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:33.819169998 CET	50079	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:33.819214106 CET	443	50079	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:33.819264889 CET	443	50079	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:35.586070061 CET	50080	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:35.586122990 CET	443	50080	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:35.586287022 CET	50080	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:35.651626110 CET	50080	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:35.651659012 CET	443	50080	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:35.651696920 CET	50080	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:35.651716948 CET	443	50080	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:35.676305056 CET	50081	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:35.676382065 CET	443	50081	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:35.676625967 CET	50081	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:35.748079062 CET	50081	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:35.748126984 CET	443	50081	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:35.748172998 CET	443	50081	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:35.776093960 CET	50082	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:35.776132107 CET	443	50082	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:35.780181885 CET	50082	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:35.843322039 CET	50082	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:35.843337059 CET	443	50082	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:35.843375921 CET	443	50082	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:35.872113943 CET	50083	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:35.872124910 CET	443	50083	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:35.872253895 CET	50083	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:35.944106102 CET	50083	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:35.944113970 CET	443	50083	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:35.944133043 CET	443	50083	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:38.028116941 CET	50084	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:38.028182983 CET	443	50084	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:38.036637068 CET	50084	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:39.115081072 CET	50084	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:39.115103960 CET	443	50084	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:39.115161896 CET	443	50084	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:41.348066092 CET	50085	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:41.348134041 CET	443	50085	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:41.352678061 CET	50085	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:41.407908916 CET	50085	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:41.407924891 CET	443	50085	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:41.407968044 CET	443	50085	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:43.569492102 CET	50086	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:43.569540024 CET	443	50086	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:43.569675922 CET	50086	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:43.802047014 CET	50086	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:43.802072048 CET	443	50086	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:43.802130938 CET	443	50086	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:43.802278996 CET	50086	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:43.802289963 CET	443	50086	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:45.204956055 CET	50087	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:45.204983950 CET	443	50087	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:45.205282927 CET	50087	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:45.270054102 CET	50087	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:45.270070076 CET	443	50087	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:45.270112991 CET	443	50087	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:45.270149946 CET	50087	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:45.270159006 CET	443	50087	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:47.314363003 CET	50088	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:47.314455032 CET	443	50088	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:47.314580917 CET	50088	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:47.369191885 CET	50088	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:47.369191885 CET	50088	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:47.369276047 CET	443	50088	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:47.369321108 CET	443	50088	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:47.369414091 CET	443	50088	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:48.392566919 CET	50089	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:48.392601013 CET	443	50089	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:48.392693996 CET	50089	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:48.452990055 CET	50089	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:48.453023911 CET	443	50089	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:48.453066111 CET	443	50089	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:48.453097105 CET	50089	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:48.453111887 CET	443	50089	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:49.470498085 CET	50090	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:49.470545053 CET	443	50090	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:49.470662117 CET	50090	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:49.509471893 CET	50090	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:49.509490013 CET	443	50090	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:49.509525061 CET	443	50090	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:50.533240080 CET	50091	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.533274889 CET	443	50091	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:50.533345938 CET	50091	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.595374107 CET	50091	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.595390081 CET	443	50091	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:50.595432043 CET	50091	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.595438957 CET	443	50091	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:50.595442057 CET	443	50091	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:50.611295938 CET	50092	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:50.611330986 CET	443	50092	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:50.611393929 CET	50092	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:50.668751001 CET	50092	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:50.668771029 CET	443	50092	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:50.668813944 CET	50092	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:50.668819904 CET	443	50092	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:50.668833971 CET	443	50092	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:50.672094107 CET	50093	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:50.672139883 CET	443	50093	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:50.672214985 CET	50093	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:50.725016117 CET	50093	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:50.725033045 CET	443	50093	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:50.725054979 CET	443	50093	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:50.725075960 CET	50093	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:50.725086927 CET	443	50093	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:50.730696917 CET	50094	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:50.730786085 CET	443	50094	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:50.730861902 CET	50094	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:50.800170898 CET	50094	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:50.800249100 CET	443	50094	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:50.800302029 CET	443	50094	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:50.800318956 CET	50094	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:50.800349951 CET	443	50094	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:50.803626060 CET	50095	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.803709030 CET	443	50095	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:50.803786993 CET	50095	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.851757050 CET	50095	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.851843119 CET	443	50095	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:50.851874113 CET	443	50095	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:50.851900101 CET	50095	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:50.851931095 CET	443	50095	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:52.876880884 CET	50096	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:52.876928091 CET	443	50096	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:52.877171993 CET	50096	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:52.923443079 CET	50096	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:52.923459053 CET	443	50096	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:52.923491955 CET	443	50096	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:52.923513889 CET	50096	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:52.923523903 CET	443	50096	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:53.958061934 CET	50097	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:53.958101034 CET	443	50097	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:53.962102890 CET	50097	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:54.006072044 CET	50097	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:54.006072044 CET	50097	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:54.006091118 CET	443	50097	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:54.006107092 CET	443	50097	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:54.006134033 CET	443	50097	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:54.006134987 CET	50097	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:54.006145954 CET	443	50097	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:55.039886951 CET	50098	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:55.039975882 CET	443	50098	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:55.040066004 CET	50098	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:55.167834044 CET	50098	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:55.167834044 CET	50098	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:55.167879105 CET	443	50098	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:55.167902946 CET	443	50098	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:55.167980909 CET	443	50098	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:55.170069933 CET	50098	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:52:55.170093060 CET	443	50098	34.83.67.185	192.168.2.5
Dec 24, 2024 20:52:56.190956116 CET	50099	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:56.191051960 CET	443	50099	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:56.191186905 CET	50099	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:56.270066023 CET	50099	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:56.270138979 CET	443	50099	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:56.270184994 CET	443	50099	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:56.270186901 CET	50099	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:52:56.270210981 CET	443	50099	35.195.45.98	192.168.2.5
Dec 24, 2024 20:52:58.314882040 CET	50100	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:58.314970016 CET	443	50100	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:58.315063953 CET	50100	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:58.374898911 CET	50100	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:58.374948978 CET	443	50100	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:58.375010967 CET	50100	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:52:58.375025988 CET	443	50100	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:58.375040054 CET	443	50100	34.34.145.103	192.168.2.5
Dec 24, 2024 20:52:59.392187119 CET	50101	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:59.392271042 CET	443	50101	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:59.394167900 CET	50101	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:59.434077024 CET	50101	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:52:59.434118986 CET	443	50101	34.169.99.17	192.168.2.5
Dec 24, 2024 20:52:59.434185028 CET	443	50101	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:00.455051899 CET	50102	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:00.455101967 CET	443	50102	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:00.455163002 CET	50102	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:00.520562887 CET	50102	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:00.520572901 CET	443	50102	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:00.520607948 CET	443	50102	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:00.520633936 CET	50102	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:00.520642996 CET	443	50102	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:01.549180984 CET	50103	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.549220085 CET	443	50103	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:01.549314022 CET	50103	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.628273010 CET	50103	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.628288984 CET	443	50103	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:01.628328085 CET	443	50103	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:01.628353119 CET	50103	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.628364086 CET	443	50103	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:01.640279055 CET	50104	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:01.640340090 CET	443	50104	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:01.640458107 CET	50104	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:01.685269117 CET	50104	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:01.685269117 CET	50104	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:01.685288906 CET	443	50104	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:01.685298920 CET	443	50104	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:01.685331106 CET	443	50104	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:01.687999964 CET	50105	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:53:01.688019037 CET	443	50105	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:01.688376904 CET	50105	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:53:01.740005970 CET	50105	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:53:01.740011930 CET	443	50105	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:01.740031958 CET	443	50105	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:01.744786024 CET	50106	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:01.744874001 CET	443	50106	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:01.744980097 CET	50106	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:01.800311089 CET	50106	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:01.800343037 CET	443	50106	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:01.800379992 CET	443	50106	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:01.800429106 CET	50106	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:01.800451040 CET	443	50106	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:01.803040981 CET	50107	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.803061962 CET	443	50107	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:01.803159952 CET	50107	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.842643023 CET	50107	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.842672110 CET	443	50107	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:01.842716932 CET	443	50107	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:01.842727900 CET	50107	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:01.842746973 CET	443	50107	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:03.876899004 CET	50108	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:03.876928091 CET	443	50108	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:03.877005100 CET	50108	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:03.916415930 CET	50108	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:03.916430950 CET	443	50108	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:03.916480064 CET	443	50108	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:03.916484118 CET	50108	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:53:03.916495085 CET	443	50108	34.34.145.103	192.168.2.5
Dec 24, 2024 20:53:04.939456940 CET	50109	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:53:04.939553022 CET	443	50109	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:04.939649105 CET	50109	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:53:04.997392893 CET	50109	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:53:04.997415066 CET	443	50109	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:04.997447014 CET	443	50109	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:04.997463942 CET	50109	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:53:04.997474909 CET	443	50109	34.169.99.17	192.168.2.5
Dec 24, 2024 20:53:06.047744989 CET	50110	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:06.047780037 CET	443	50110	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:06.047909021 CET	50110	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:06.099941015 CET	50110	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:53:06.099955082 CET	443	50110	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:06.099987984 CET	443	50110	34.83.67.185	192.168.2.5
Dec 24, 2024 20:53:07.110208988 CET	50111	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:07.110260963 CET	443	50111	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:07.110419989 CET	50111	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:07.154377937 CET	50111	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:07.154397964 CET	443	50111	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:07.154438972 CET	443	50111	35.195.45.98	192.168.2.5
Dec 24, 2024 20:53:07.156233072 CET	50111	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:53:07.156244993 CET	443	50111	35.195.45.98	192.168.2.5

Target ID:	0
Start time:	14:48:57
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\gfehgfwveg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gfehgfwveg.exe"
Imagebase:	0x400000
File size:	4'276'224 bytes
MD5 hash:	43EC2649E1B173B6E8B3800E18CCEEB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	14:49:00
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:49:00
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	14:49:00
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Imagebase:	0x5b0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true