Play interactive tour

Edit tour

Windows Analysis Report dllhost.exe

Overview

General Information

Sample Name:	dllhost.exe
Analysis ID:	486542
MD5:	fb4c1f5ec7701209f0a1dcd0726dc403
SHA1:	fed324a956bb72fc10928806d887ecd4556a1f3a
SHA256:	e75d883d14ab80d900fc21bd6ea9bc3bafc77f7fd31ddf66fa715833e71e8013
Infos:
Most interesting Screenshot:

Detection

Nanominer

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Yara detected Nanominer

Hides threads from debuggers

Found strings related to Crypto-Mining

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

DNS related to crypt mining pools

Machine Learning detection for sample

Queries the volume information (name, serial number etc) of a device

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

May sleep (evasive loops) to hinder dynamic analysis

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains capabilities to detect virtual machines

PE file contains more sections than normal

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

IP address seen in connection with other malware

Entry point lies outside standard sections

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

dllhost.exe (PID: 2276 cmdline: 'C:\Users\user\Desktop\dllhost.exe' MD5: FB4C1F5EC7701209F0A1DCD0726DC403)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	JoeSecurity_Nanominer	Yara detected Nanominer	Joe Security
Process Memory Space: dllhost.exe PID: 2276	JoeSecurity_Nanominer	Yara detected Nanominer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.3.dllhost.exe.28fa8880000.0.unpack	JoeSecurity_Nanominer	Yara detected Nanominer	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Machine Learning detection for sample

Show sources

Source: dllhost.exe

Joe Sandbox ML: detected

Bitcoin Miner:

Yara detected Nanominer

Show sources

Source: Yara match	File source: 1.3.dllhost.exe.28fa8880000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dllhost.exe PID: 2276, type: MEMORYSTR

Found strings related to Crypto-Mining

Show sources

Source: dllhost.exe

String found in binary or memory: .?AV?$_Binder@U_Unforced@std@@P8IClient@@EAAXAEBV?$variant@UEthashResult@@UCryptonightResult@@UVerusHashResult@@@2@AEBV?$variant@UEthashTask@@UCryptonightInput@@UVerusHashInput@@@2@V?$shared_ptr@UDevice@@@2@@ZAEAPEAV3@AEBU?$_Ph@$00@2@AEBU?$_Ph@$01@2@AEAV62@@std@@

DNS related to crypt mining pools

Show sources

Source: unknown	DNS query: name: xmr-au1.nanopool.org
Source: unknown	DNS query: name: xmr-jp1.nanopool.org
Source: unknown	DNS query: name: xmr-eu1.nanopool.org
Source: unknown	DNS query: name: xmr-us-west1.nanopool.org
Source: unknown	DNS query: name: xmr-us-east1.nanopool.org
Source: unknown	DNS query: name: xmr-eu2.nanopool.org
Source: unknown	DNS query: name: xmr-asia1.nanopool.org

Source:	Binary string: Z:\Development\Secureuser\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: dllhost.exe, 00000001.00000000.409581637.00007FF6E7407000.00000080.00020000.sdmp, 477ae13b.dll.1.dr
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: dllhost.exe, 00000001.00000000.418040183.00007FF6E8CA3000.00000080.00020000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: dllhost.exe, 00000001.00000000.418040183.00007FF6E8CA3000.00000080.00020000.sdmp

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-au1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.99.102.71 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: jp.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.99.102.73 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 18.180.72.219 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.99.156.30 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-jp1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: fi.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-eu1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-us-west1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-eu2.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 8.8.8.8 53	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr.2miners.com
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: gulf.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 192.99.69.170 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 54.188.223.206 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 207.246.100.198 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: us-oh.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 45.76.65.223 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: fr.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.15.54.102 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: us-va.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.89.96.41 174	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.255.34.79 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-us-east1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 54.255.104.167 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: us-or.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 18.210.126.40 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: de.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.83.61.76 80	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 185.71.66.31 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 151.80.144.188 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: proxycenter.geekgalaxy.com
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.162.112.195 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 195.201.124.214 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: sg.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-asia1.nanopool.org

Source: global traffic	TCP traffic: 192.168.2.6:49761 -> 54.255.104.167:10128
Source: global traffic	TCP traffic: 192.168.2.6:49762 -> 139.162.112.195:14444
Source: global traffic	TCP traffic: 192.168.2.6:49763 -> 51.89.96.41:2222
Source: global traffic	TCP traffic: 192.168.2.6:49764 -> 139.99.102.73:14444
Source: global traffic	TCP traffic: 192.168.2.6:49766 -> 51.83.61.76:8080
Source: global traffic	TCP traffic: 192.168.2.6:49768 -> 51.255.34.79:14444
Source: global traffic	TCP traffic: 192.168.2.6:49769 -> 195.201.124.214:10128
Source: global traffic	TCP traffic: 192.168.2.6:49770 -> 185.71.66.31:14444
Source: global traffic	TCP traffic: 192.168.2.6:49771 -> 139.99.156.30:14444
Source: global traffic	TCP traffic: 192.168.2.6:49773 -> 18.210.126.40:10128
Source: global traffic	TCP traffic: 192.168.2.6:49774 -> 45.76.65.223:14444
Source: global traffic	TCP traffic: 192.168.2.6:49778 -> 18.180.72.219:10128
Source: global traffic	TCP traffic: 192.168.2.6:49780 -> 54.188.223.206:10128
Source: global traffic	TCP traffic: 192.168.2.6:49783 -> 151.80.144.188:14444
Source: global traffic	TCP traffic: 192.168.2.6:49786 -> 51.15.54.102:14444
Source: global traffic	TCP traffic: 192.168.2.6:49792 -> 139.99.102.71:14444
Source: global traffic	TCP traffic: 192.168.2.6:49795 -> 207.246.100.198:14444

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View	IP Address: 51.15.54.102 51.15.54.102
Source: Joe Sandbox View	IP Address: 51.89.96.41 51.89.96.41

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443

Source: dllhost.exe, 00000001.00000003.448249928.0000028FA8880000.00000004.00000001.sdmp	String found in binary or memory: http://.css
Source: dllhost.exe, 00000001.00000003.448249928.0000028FA8880000.00000004.00000001.sdmp	String found in binary or memory: http://.jpg
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: dllhost.exe, 00000001.00000003.448249928.0000028FA8880000.00000004.00000001.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: https://api.nanopool.org/v1/invalid
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0D

Source: unknown

DNS traffic detected: queries for: sg.moneroocean.stream

Source: dllhost.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dllhost.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dllhost.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: .dll			Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: nvcuda.dll			Jump to behavior

Source: dllhost.exe

Static PE information: Number of sections : 16 > 10

Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 70A00000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 70A00000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 70A01000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 70DAA000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 70E56000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71135000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71136000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71137000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71172000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71173000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71174000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71175000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory allocated: 71176000 page read and write	Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe

Process Stats: CPU usage > 98%

Source: 477ae13b.dll.1.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: dllhost.exe

Static PE information: Section: .reloc ZLIB complexity 1.5

Source: C:\Users\user\Desktop\dllhost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\dllhost.exe 'C:\Users\user\Desktop\dllhost.exe'
Source: C:\Users\user\Desktop\dllhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_01

Source: dllhost.exe

Binary or memory string: V.SlN75?'j

Source: C:\Users\user\Desktop\dllhost.exe

File created: C:\Users\user\AppData\Local\Temp\477ae13b.dll

Jump to behavior

Source: dllhost.exe	String found in binary or memory: 3.3.9-cuda11commandsimpleoverclockingpowerlimitsstatisticresume0restartstoppauserebootcontrolGpugray-horTerminating, please wait ...--help-dUsage: [config file] [options]sOptions:.-h Print this message and quit:-d List available GPU devices deviceDetected MB PCI
Source: dllhost.exe	String found in binary or memory: 3.3.9-cuda11commandsimpleoverclockingpowerlimitsstatisticresume0restartstoppauserebootcontrolGpugray-horTerminating, please wait ...--help-dUsage: [config file] [options]sOptions:.-h Print this message and quit:-d List available GPU devices deviceDetected MB PCI

Source: classification engine

Classification label: mal80.evad.mine.winEXE@2/1@37/19

Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: dllhost.exe

Static file information: File size 67306240 > 1048576

Source: dllhost.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: dllhost.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: dllhost.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1e4200
Source: dllhost.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x917400
Source: dllhost.exe	Static PE information: Raw size of __nv_rel is bigger than: 0x100000 < 0x811000
Source: dllhost.exe	Static PE information: Raw size of .nv_fatb is bigger than: 0x100000 < 0xf7fe00
Source: dllhost.exe	Static PE information: Raw size of .themida is bigger than: 0x100000 < 0x1ce8000

Source:	Binary string: Z:\Development\Secureuser\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: dllhost.exe, 00000001.00000000.409581637.00007FF6E7407000.00000080.00020000.sdmp, 477ae13b.dll.1.dr
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: dllhost.exe, 00000001.00000000.418040183.00007FF6E8CA3000.00000080.00020000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: dllhost.exe, 00000001.00000000.418040183.00007FF6E8CA3000.00000080.00020000.sdmp

Source: dllhost.exe	Static PE information: real checksum: 0x4039cb2 should be:
Source: 477ae13b.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0xe963

Source: dllhost.exe	Static PE information: section name: _RANDOMX
Source: dllhost.exe	Static PE information: section name: __nv_mod
Source: dllhost.exe	Static PE information: section name: __nv_rel
Source: dllhost.exe	Static PE information: section name: .nvFatBi
Source: dllhost.exe	Static PE information: section name: .nv_fatb
Source: dllhost.exe	Static PE information: section name: .themida

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

Source: C:\Users\user\Desktop\dllhost.exe

File created: C:\Users\user\AppData\Local\Temp\477ae13b.dll

Jump to dropped file

Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\Desktop\dllhost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\Desktop\dllhost.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe TID: 6308	Thread sleep time: -83000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe TID: 3324	Thread sleep time: -69000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\dllhost.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-au1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.99.102.71 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: jp.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.99.102.73 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 18.180.72.219 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.99.156.30 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-jp1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: fi.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-eu1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-us-west1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-eu2.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 8.8.8.8 53	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr.2miners.com
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: gulf.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 192.99.69.170 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 54.188.223.206 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 207.246.100.198 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: us-oh.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 45.76.65.223 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: fr.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.15.54.102 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: us-va.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.89.96.41 174	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.255.34.79 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-us-east1.nanopool.org
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 54.255.104.167 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: us-or.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 18.210.126.40 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: de.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 51.83.61.76 80	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 185.71.66.31 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 151.80.144.188 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: proxycenter.geekgalaxy.com
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 139.162.112.195 108	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Network Connect: 195.201.124.214 144	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: sg.moneroocean.stream
Source: C:\Users\user\Desktop\dllhost.exe	Domain query: xmr-asia1.nanopool.org

Source: C:\Users\user\Desktop\dllhost.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	DLL Side-Loading1	Process Injection11	Virtualization/Sandbox Evasion23	OS Credential Dumping	Security Software Discovery32	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Process Injection11	LSASS Memory	Virtualization/Sandbox Evasion23	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing2	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dllhost.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://.css	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
xmr-au1.nanopool.org	139.99.156.30	true	false	high
jp.moneroocean.stream	18.180.72.219	true	false	high
fr.moneroocean.stream	195.201.124.214	true	false	high
xmr-jp1.nanopool.org	139.162.112.195	true	false	high
us-va.moneroocean.stream	18.210.126.40	true	false	high
monerooceans.stream	195.201.124.214	true	true	unknown
fi.moneroocean.stream	195.201.124.214	true	false	high
xmr-eu1.nanopool.org	185.71.66.31	true	false	high
xmr-us-west1.nanopool.org	45.76.65.223	true	false	high
xmr-us-east1.nanopool.org	192.99.69.170	true	false	high
xmr-eu2.nanopool.org	51.255.34.79	true	false	high
us-or.moneroocean.stream	54.188.223.206	true	false	high
xmr.2miners.com	51.89.96.41	true	false	high
de.moneroocean.stream	195.201.124.214	true	false	high
us-oh.moneroocean.stream	18.210.126.40	true	false	high
proxycenter.geekgalaxy.com	51.83.61.76	true	true	unknown
sg.moneroocean.stream	54.255.104.167	true	false	high
xmr-asia1.nanopool.org	139.99.102.73	true	false	high
gulf.moneroocean.stream	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://html4/loose.dtd	dllhost.exe, 00000001.00000003.448249928.0000028FA8880000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://sectigo.com/CPS0	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.nanopool.org/v1/invalid	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	dllhost.exe, 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://.css	dllhost.exe, 00000001.00000003.448249928.0000028FA8880000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://.jpg	dllhost.exe, 00000001.00000003.448249928.0000028FA8880000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
139.99.102.71	unknown	Canada	16276	OVHFR	true
139.99.102.73	xmr-asia1.nanopool.org	Canada	16276	OVHFR	false
18.180.72.219	jp.moneroocean.stream	United States	16509	AMAZON-02US	false
51.15.54.102	unknown	France	12876	OnlineSASFR	true
139.99.156.30	xmr-au1.nanopool.org	Canada	16276	OVHFR	false
51.89.96.41	xmr.2miners.com	France	16276	OVHFR	false
51.255.34.79	xmr-eu2.nanopool.org	France	16276	OVHFR	false
54.255.104.167	sg.moneroocean.stream	United States	16509	AMAZON-02US	false
18.210.126.40	us-va.moneroocean.stream	United States	14618	AMAZON-AESUS	false
51.83.61.76	proxycenter.geekgalaxy.com	France	16276	OVHFR	true
185.71.66.31	xmr-eu1.nanopool.org	Russian Federation	59796	STORMSYSTEMS-ASRU	false
192.99.69.170	xmr-us-east1.nanopool.org	Canada	16276	OVHFR	false
54.188.223.206	us-or.moneroocean.stream	United States	16509	AMAZON-02US	false
207.246.100.198	unknown	United States	20473	AS-CHOOPAUS	true
151.80.144.188	unknown	Italy	16276	OVHFR	true
139.162.112.195	xmr-jp1.nanopool.org	Netherlands	63949	LINODE-APLinodeLLCUS	false
195.201.124.214	fr.moneroocean.stream	Germany	24940	HETZNER-ASDE	false
45.76.65.223	xmr-us-west1.nanopool.org	United States	20473	AS-CHOOPAUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	486542
Start date:	20.09.2021
Start time:	16:15:57
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	dllhost.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.evad.mine.winEXE@2/1@37/19
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.189.173.22, 23.211.6.115, 52.182.143.212, 104.208.16.94, 20.82.209.183, 20.54.110.249, 23.211.4.86 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, onedsblobprdwus17.westus.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, onedsblobprdcus15.centralus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, onedsblobprdcus16.centralus.cloudapp.azure.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/486542/sample/dllhost.exe

Simulations

Behavior and APIs

Time	Type	Description
16:17:53	API Interceptor	2x Sleep call for process: dllhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
139.99.102.73	RuntimeBroker.exe	Get hash	malicious	Browse
51.15.54.102	wJtL8lkk83.exe	Get hash	malicious	Browse
	YbVuzaXA3o.exe	Get hash	malicious	Browse
	tSXyqrumfM.exe	Get hash	malicious	Browse
	LAcZLfYrj5.exe	Get hash	malicious	Browse
	activation.exe	Get hash	malicious	Browse
	mCiZXEeKax.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Bulz.242344.9747.exe	Get hash	malicious	Browse
139.99.156.30	RuntimeBroker.exe	Get hash	malicious	Browse
139.99.156.30	vilxost.dll	Get hash	malicious	Browse
51.89.96.41	mDkCoW1yzV.exe	Get hash	malicious	Browse
	5siADx4Pdz.exe	Get hash	malicious	Browse
	Intaller.exe	Get hash	malicious	Browse
	c104a3a9c34f9afdab2e77874d9b8b6fda14b689_2021-09-09_15-02.exe	Get hash	malicious	Browse
	t1YS17PfeB.exe	Get hash	malicious	Browse
	Y54o1vpvV6.exe	Get hash	malicious	Browse
	eTWeOVTyE0.exe	Get hash	malicious	Browse
	hk74Rh7zD5.exe	Get hash	malicious	Browse
	noapPl7Cpu.exe	Get hash	malicious	Browse
	Vl4JzTDzmQ.exe	Get hash	malicious	Browse
	SKj2xw6rtb.exe	Get hash	malicious	Browse
	BT1tlwpfkU.exe	Get hash	malicious	Browse
	0rRGEsopLg.exe	Get hash	malicious	Browse
	F3hrptTSsK.exe	Get hash	malicious	Browse
	OZixe06aPK.exe	Get hash	malicious	Browse
	axbSBfbrX5.exe	Get hash	malicious	Browse
	caUPp3yUt7.exe	Get hash	malicious	Browse
	hy2x7ex1Ny.exe	Get hash	malicious	Browse
	03soKqWLfN.exe	Get hash	malicious	Browse
	LinkMiner.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
xmr-eu1.nanopool.org	SecuriteInfo.com.Trojan.GenericKD.46968833.5808.exe	Get hash	malicious	Browse	51.15.69.136
	wJtL8lkk83.exe	Get hash	malicious	Browse	51.68.143.81
	7liS1YWCOy.exe	Get hash	malicious	Browse	51.15.54.102
	2qE9TLzYDn.exe	Get hash	malicious	Browse	185.71.66.31
	YbVuzaXA3o.exe	Get hash	malicious	Browse	46.105.31.147
	6Ttcu4rR5x.exe	Get hash	malicious	Browse	51.15.54.102
	yNGNc3hC9Z.exe	Get hash	malicious	Browse	51.15.78.68
	luJ6rWt8TR.exe	Get hash	malicious	Browse	46.105.31.147
	8500F1744E517DFA7E8F0E08AEEA29CA2625695EE2B90.exe	Get hash	malicious	Browse	217.182.169.148
	tSXyqrumfM.exe	Get hash	malicious	Browse	51.15.54.102
	1LhhZPI9MH.exe	Get hash	malicious	Browse	135.125.238.108
	vh12mmuxpj.exe	Get hash	malicious	Browse	51.15.54.102
	HNEhMTzIxu.exe	Get hash	malicious	Browse	46.105.31.147
	zfIIQ6GWAy.exe	Get hash	malicious	Browse	51.15.69.136
	Y6pCQH96bh.exe	Get hash	malicious	Browse	51.15.65.182
	GloryWSetp.exe	Get hash	malicious	Browse	46.105.31.147
	UvVE6mXveZ.exe	Get hash	malicious	Browse	51.15.78.68
	zWK4m28G41.exe	Get hash	malicious	Browse	51.255.34.118
	HbkQ7SSRP7.exe	Get hash	malicious	Browse	51.15.65.182
	LAcZLfYrj5.exe	Get hash	malicious	Browse	51.15.69.136
xmr-au1.nanopool.org	vilxost.dll	Get hash	malicious	Browse	139.99.156.30
monerooceans.stream	http://gulf.moneroocean.stream	Get hash	malicious	Browse	3.125.10.23

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	METALES COSTA DEL SOL S.L. Offer 20211445.exe	Get hash	malicious	Browse	37.59.226.120
	OHlT14GyKR.exe	Get hash	malicious	Browse	146.59.132.186
	h0nSzCFt9G.exe	Get hash	malicious	Browse	51.161.12.29
	q8ylcxt6aJ.exe	Get hash	malicious	Browse	54.37.84.240
	IMG_Order PO 094765 SMH.doc	Get hash	malicious	Browse	146.59.132.186
	IMG_Order SPECIFICATION 094765 img.doc	Get hash	malicious	Browse	146.59.132.186
	DmTTJwbVpC.exe	Get hash	malicious	Browse	176.31.32.198
	RuntimeBroker.exe	Get hash	malicious	Browse	144.217.14.109
	9LrGqSL8FN.exe	Get hash	malicious	Browse	37.187.95.110
	Quotation-Pepper Fuchs- Asia Pte. Ltd..exe	Get hash	malicious	Browse	54.36.145.173
	REMITTANCE COPY.exe	Get hash	malicious	Browse	51.79.243.138
	PiVcyIi160.exe	Get hash	malicious	Browse	87.98.153.120
	PiVcyIi160.exe	Get hash	malicious	Browse	87.98.153.120
	2RPumB2hAm.exe	Get hash	malicious	Browse	51.178.186.149
	FA387CD1B39ABC702BE4CED41227BF752BAD3B17430B3.exe	Get hash	malicious	Browse	87.98.153.120
	x2HPpQ02mD	Get hash	malicious	Browse	192.95.63.111
	HoGxvkYZd5	Get hash	malicious	Browse	164.132.217.117
	setup_x86_x64_install.exe	Get hash	malicious	Browse	51.178.186.149
	oqYSjv0q9v.exe	Get hash	malicious	Browse	51.178.186.149
	c6d1hg7s8b.exe	Get hash	malicious	Browse	87.98.153.120
OVHFR	METALES COSTA DEL SOL S.L. Offer 20211445.exe	Get hash	malicious	Browse	37.59.226.120
	OHlT14GyKR.exe	Get hash	malicious	Browse	146.59.132.186
	h0nSzCFt9G.exe	Get hash	malicious	Browse	51.161.12.29
	q8ylcxt6aJ.exe	Get hash	malicious	Browse	54.37.84.240
	IMG_Order PO 094765 SMH.doc	Get hash	malicious	Browse	146.59.132.186
	IMG_Order SPECIFICATION 094765 img.doc	Get hash	malicious	Browse	146.59.132.186
	DmTTJwbVpC.exe	Get hash	malicious	Browse	176.31.32.198
	RuntimeBroker.exe	Get hash	malicious	Browse	144.217.14.109
	9LrGqSL8FN.exe	Get hash	malicious	Browse	37.187.95.110
	Quotation-Pepper Fuchs- Asia Pte. Ltd..exe	Get hash	malicious	Browse	54.36.145.173
	REMITTANCE COPY.exe	Get hash	malicious	Browse	51.79.243.138
	PiVcyIi160.exe	Get hash	malicious	Browse	87.98.153.120
	PiVcyIi160.exe	Get hash	malicious	Browse	87.98.153.120
	2RPumB2hAm.exe	Get hash	malicious	Browse	51.178.186.149
	FA387CD1B39ABC702BE4CED41227BF752BAD3B17430B3.exe	Get hash	malicious	Browse	87.98.153.120
	x2HPpQ02mD	Get hash	malicious	Browse	192.95.63.111
	HoGxvkYZd5	Get hash	malicious	Browse	164.132.217.117
	setup_x86_x64_install.exe	Get hash	malicious	Browse	51.178.186.149
	oqYSjv0q9v.exe	Get hash	malicious	Browse	51.178.186.149
	c6d1hg7s8b.exe	Get hash	malicious	Browse	87.98.153.120

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\477ae13b.dll Download File
Process:	C:\Users\user\Desktop\dllhost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	1.8790345847683234
Encrypted:	false
SSDEEP:	48:aOyTG0Cfj3gFu/+LIa0Wh4PYCvo+ocjpaRuqSx:xIG3jr+Ud3Q+f6x
MD5:	4D2FFA82BEB49D0C5DC38B4C9107277F
SHA1:	CB73EE2A22C8B0D732D872B7C0D401790D6B9F99
SHA-256:	9BE643CC30F84C35739966E8907866CD7323097610275A534E0A14CE993EA89C
SHA-512:	5F5808FB596DA4F9F9FFCBF622A1F0FD8F03D548A94F344D6FDE231027934F88ABB07A5529A85042FF6BD519FEB857E452F885853558568612A75973628FE8A3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a.5.%.[.%.[.%.[...^.$.[..._.!.[...X.'.[..D..&.[.%.Z.,.[...R.&.[...$.[...Y.$.[.Rich%.[.........PE..d......`.........." .........(............................................................`.................................................4$..(............@..H............... ...p ..p...................x!..(.... ............... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata..H....@......................@..@.tls.........P......................@....CRT.........p......."..............@..@.gfids...............$..............@..@.rsrc................&..............@..@.reloc.. ............(..............@..B........................................................................................................................................................

Static File Info

General
File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.5724463090507035
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dllhost.exe
File size:	67306240
MD5:	fb4c1f5ec7701209f0a1dcd0726dc403
SHA1:	fed324a956bb72fc10928806d887ecd4556a1f3a
SHA256:	e75d883d14ab80d900fc21bd6ea9bc3bafc77f7fd31ddf66fa715833e71e8013
SHA512:	93975c2ee0e6f6e3180ed2ca4e02ad9efa955a8371aca34378855d92a31e442867d2b3e74a0596e556aedb391df1faa0b0ec70b48c91b82132378e764f29364c
SSDEEP:	786432:JzWoUGA77p/YwHBl3o5VbfF3ymyo+JazDxfmwW8XuHNgxQy5D:JqyoBlYFUmyjufm18XuHWH
File Content Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......\|G..8&..8&..8&..cN..p&..cN..&&..cN...&..jN..1&..jN...&..jN...&..1^:.9&..cN..3&..8&..''....p.9&....q.7&...O..:&...O..*&...O..N'.

File Icon


Icon Hash:	f0d0a2f071b2cce8

Static PE Info

General
Entrypoint:	0x143b94c3c
Entrypoint Section:	.themida
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, HIGH_ENTROPY_VA
Time Stamp:	0x613A5D1E [Thu Sep 9 19:14:38 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ea0f3ee678ff96b92572b920efa689ea

Entrypoint Preview

Instruction
push ebp
jmp 00007FCBDCD15F20h
pop ebp
jmp 00007FCBDCCC8DD5h
fisttp qword ptr [esi]
add byte ptr [eax], al
add dl, cl
add byte ptr [edx-07B510CAh], bh
mov dl, EDh
xchg eax, ebx
cmpsd
or eax, dword ptr [bx+si]
retf E800h
out dx, eax
mov cl, byte ptr [ecx-66C8ABF6h]
push ebx
and al, 9Fh
scasd
test al, 19h
sbb al, FBh
call far E900h : 04C795E9h
loopne 00007FCBDCCB49B2h
or byte ptr [eax], al
jmp 00007FCBDB4B9E8Bh
jmp 00007FCBDCC9117Fh
test al, 0Eh
add byte ptr [eax], al
add dl, cl
add al, bh
out dx, eax
in al, 50h
jmp 00007FCBDCCB4989h
pop esi
bound esi, dword ptr [ecx+09h]
add dl, cl
add byte ptr [ecx+37h], ch
out dx, eax
test dword ptr [ebx-3B30FB43h], esp
add al, E1h
jnbe 00007FCBDCCB4952h
pop ebx
test cl, cl
inc ebp
add dword ptr [ebx], ebp
and al, B0h
and dword ptr [eax+01h], ebp
popad
add byte ptr [esi], cl
add byte ptr [eax], al
add byte ptr [ebp+01h], al
scasd
inc edi
daa
inc ebp
add dword ptr [eax], 8BC70061h

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[C++] VS2012 build 50727
[ C ] VS2012 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2352000	0x58	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23530a1	0xd0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x233a000	0x14f3e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x40186ac	0x13788	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x403f000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2356018	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x26eb5c	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1e4093	0x1e4200	False	0.445640794442	zlib compressed data	6.39722119727	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1e6000	0x8a9b4	0x8aa00	False	0.37196200124	data	5.01719863353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x271000	0x920864	0x917400	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xb92000	0x13764	0x13800	False	0.481733273237	data	6.15140087656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RANDOMX	0xba6000	0x556	0x600	False	0.529947916667	data	5.49170654418	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
__nv_mod	0xba7000	0x1b4	0x200	False	0.265625	data	4.16935929547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
__nv_rel	0xba8000	0x810f88	0x811000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.nvFatBi	0x13b9000	0x90	0x200	False	0.150390625	data	1.20360561451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.nv_fatb	0x13ba000	0xf7fc30	0xf7fe00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x233a000	0x14f3e	0x15000	False	0.427722749256	data	5.50361278507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x234f000	0x2ff0	0x3000	False	0.288004557292	data	5.45803574263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.edata	0x2352000	0x1000	0x200	False	0.1640625	data	1.16110503859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x2353000	0x1000	0x200	False	0.37109375	data	2.9470966786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x2354000	0x3000	0x2200	False	0.00735294117647	data	0.0248387677496	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.themida	0x2357000	0x1ce8000	0x1ce8000	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.reloc	0x403f000	0x1000	0x10	False	1.5	GLS_BINARY_LSB_FIRST	2.73345859334	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x233a27c	0xea8	data	Portuguese	Brazil
RT_ICON	0x233b124	0x568	GLS_BINARY_LSB_FIRST	Portuguese	Brazil
RT_ICON	0x233b68c	0xca8	dBase IV DBT of @.DBF, block length 3072, next free block index 40, next free block 145, next used block 0	Portuguese	Brazil
RT_ICON	0x233c334	0x368	GLS_BINARY_LSB_FIRST	Portuguese	Brazil
RT_ICON	0x233c69c	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	Portuguese	Brazil
RT_ICON	0x234cec4	0x10a8	data	Portuguese	Brazil
RT_ICON	0x234df6c	0x468	GLS_BINARY_LSB_FIRST	Portuguese	Brazil
RT_GROUP_ICON	0x234e3d4	0x68	data	Portuguese	Brazil
RT_VERSION	0x234e43c	0x388	data	English	United States
RT_VERSION	0x234e7c4	0x290	MS Windows COFF PA-RISC object file	Portuguese	Brazil
RT_MANIFEST	0x234ea54	0x4ea	XML 1.0 document, ASCII text, with CRLF line terminators	Portuguese	Brazil

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
IPHLPAPI.DLL	GetAdaptersInfo
SHELL32.dll	CommandLineToArgvW
ADVAPI32.dll	LookupPrivilegeValueA
dbghelp.dll	ImageNtHeader

Exports

Name	Ordinal	Address
NvOptimusEnablementCuda	1	0x140b7f89c

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	dllhost.exe
FileVersion	10.0.19041.546 (WinBuild.160101.0800)
CompanyName	Microsoft Corporation
ProductName	Microsoft Windows Operating System
ProductVersion	10.0.19041.546
FileDescription	COM Surrogate
OriginalFilename	dllhost.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Portuguese	Brazil
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/20/21-16:17:52.074810	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62208	8.8.8.8	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 20, 2021 16:17:51.975172997 CEST	49761	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:51.978549957 CEST	49762	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:52.049310923 CEST	49763	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.049324989 CEST	49764	14444	192.168.2.6	139.99.102.73
Sep 20, 2021 16:17:52.068898916 CEST	2222	49763	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:52.069183111 CEST	49763	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.086744070 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.086832047 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.086872101 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.087775946 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.090205908 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.111386061 CEST	49768	14444	192.168.2.6	51.255.34.79
Sep 20, 2021 16:17:52.114509106 CEST	8080	49766	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.114775896 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.116662025 CEST	80	49767	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.118068933 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.126249075 CEST	49769	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.130592108 CEST	49770	14444	192.168.2.6	185.71.66.31
Sep 20, 2021 16:17:52.134838104 CEST	10128	49761	54.255.104.167	192.168.2.6
Sep 20, 2021 16:17:52.135106087 CEST	49761	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.137572050 CEST	14444	49768	51.255.34.79	192.168.2.6
Sep 20, 2021 16:17:52.141011953 CEST	49768	14444	192.168.2.6	51.255.34.79
Sep 20, 2021 16:17:52.146661997 CEST	49771	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:52.147989035 CEST	10128	49769	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.148165941 CEST	49769	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.153719902 CEST	49772	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.166229010 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.166245937 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.167704105 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.167712927 CEST	49763	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.168682098 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.172578096 CEST	49769	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.172616005 CEST	49768	14444	192.168.2.6	51.255.34.79
Sep 20, 2021 16:17:52.173711061 CEST	49773	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.173798084 CEST	49761	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.175466061 CEST	49774	14444	192.168.2.6	45.76.65.223
Sep 20, 2021 16:17:52.175916910 CEST	10128	49772	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.177424908 CEST	49772	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.183340073 CEST	49772	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.187194109 CEST	49775	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.187593937 CEST	2222	49763	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:52.187657118 CEST	2222	49763	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:52.188143969 CEST	49763	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.188164949 CEST	49763	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.192534924 CEST	14444	49770	185.71.66.31	192.168.2.6
Sep 20, 2021 16:17:52.194190979 CEST	10128	49769	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.194420099 CEST	49770	14444	192.168.2.6	185.71.66.31
Sep 20, 2021 16:17:52.194858074 CEST	10128	49769	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.195213079 CEST	49769	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.198206902 CEST	49769	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.198971987 CEST	14444	49768	51.255.34.79	192.168.2.6
Sep 20, 2021 16:17:52.199393988 CEST	14444	49768	51.255.34.79	192.168.2.6
Sep 20, 2021 16:17:52.199449062 CEST	80	49767	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.199502945 CEST	49768	14444	192.168.2.6	51.255.34.79
Sep 20, 2021 16:17:52.200062037 CEST	49768	14444	192.168.2.6	51.255.34.79
Sep 20, 2021 16:17:52.200516939 CEST	8080	49766	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.202172995 CEST	49770	14444	192.168.2.6	185.71.66.31
Sep 20, 2021 16:17:52.204440117 CEST	49776	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.205497980 CEST	10128	49772	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.205558062 CEST	49777	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.206331968 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.206376076 CEST	10128	49772	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.206515074 CEST	49772	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.207071066 CEST	49772	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.207072973 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.207149029 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.207561970 CEST	2222	49763	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:52.208699942 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.208756924 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.209013939 CEST	10128	49775	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.210094929 CEST	49775	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.210190058 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.220017910 CEST	10128	49769	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.221375942 CEST	49775	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.224356890 CEST	49779	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.224435091 CEST	49778	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:52.225281954 CEST	49780	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:52.226279974 CEST	14444	49768	51.255.34.79	192.168.2.6
Sep 20, 2021 16:17:52.229187012 CEST	10128	49772	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.229218006 CEST	14444	49764	139.99.102.73	192.168.2.6
Sep 20, 2021 16:17:52.229754925 CEST	49764	14444	192.168.2.6	139.99.102.73
Sep 20, 2021 16:17:52.232741117 CEST	80	49767	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.232767105 CEST	49781	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.232872963 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.233757973 CEST	8080	49766	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.233922958 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.235079050 CEST	80	49767	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.235101938 CEST	80	49767	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.235131025 CEST	49764	14444	192.168.2.6	139.99.102.73
Sep 20, 2021 16:17:52.235227108 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.235249043 CEST	49767	80	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.236968040 CEST	8080	49766	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.236998081 CEST	8080	49766	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.237162113 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.237180948 CEST	49766	8080	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.237900972 CEST	14444	49762	139.162.112.195	192.168.2.6
Sep 20, 2021 16:17:52.238235950 CEST	49762	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:52.238792896 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.242317915 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.242336988 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.243508101 CEST	10128	49775	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.244020939 CEST	10128	49775	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.244956970 CEST	49775	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.245910883 CEST	10128	49779	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.246037960 CEST	49779	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.251852989 CEST	2222	49781	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:52.252038956 CEST	49781	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.257118940 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.257134914 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.257560968 CEST	49775	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.257678986 CEST	14444	49770	185.71.66.31	192.168.2.6
Sep 20, 2021 16:17:52.259309053 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.259576082 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.260845900 CEST	49762	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:52.265121937 CEST	49779	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.265242100 CEST	49781	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.265364885 CEST	14444	49770	185.71.66.31	192.168.2.6
Sep 20, 2021 16:17:52.279531956 CEST	10128	49775	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.281836033 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.282038927 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.282147884 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.282161951 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.282830954 CEST	443	49765	51.83.61.76	192.168.2.6
Sep 20, 2021 16:17:52.282902956 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.283169985 CEST	49765	443	192.168.2.6	51.83.61.76
Sep 20, 2021 16:17:52.286276102 CEST	2222	49781	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:52.286468029 CEST	49781	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:52.286716938 CEST	10128	49779	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.287332058 CEST	10128	49779	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.287420988 CEST	49779	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.296134949 CEST	49782	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.298305035 CEST	49783	14444	192.168.2.6	151.80.144.188
Sep 20, 2021 16:17:52.304402113 CEST	49779	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.313348055 CEST	14444	49777	192.99.69.170	192.168.2.6
Sep 20, 2021 16:17:52.313417912 CEST	10128	49773	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.313559055 CEST	49777	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.313559055 CEST	49773	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.318506002 CEST	10128	49782	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.319176912 CEST	49782	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.325891018 CEST	10128	49779	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.327039957 CEST	14444	49783	151.80.144.188	192.168.2.6
Sep 20, 2021 16:17:52.327253103 CEST	49783	14444	192.168.2.6	151.80.144.188
Sep 20, 2021 16:17:52.333321095 CEST	49784	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.335067034 CEST	10128	49761	54.255.104.167	192.168.2.6
Sep 20, 2021 16:17:52.335099936 CEST	10128	49761	54.255.104.167	192.168.2.6
Sep 20, 2021 16:17:52.335496902 CEST	49761	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.336318016 CEST	14444	49774	45.76.65.223	192.168.2.6
Sep 20, 2021 16:17:52.337923050 CEST	49761	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.337927103 CEST	49774	14444	192.168.2.6	45.76.65.223
Sep 20, 2021 16:17:52.340151072 CEST	49782	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.340675116 CEST	49773	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.340852976 CEST	49777	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.342833042 CEST	10128	49776	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.343097925 CEST	49776	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.345938921 CEST	49785	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.347137928 CEST	49786	14444	192.168.2.6	51.15.54.102
Sep 20, 2021 16:17:52.355365992 CEST	10128	49784	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.356369972 CEST	49784	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.362566948 CEST	10128	49782	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.363282919 CEST	49782	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.367899895 CEST	10128	49785	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.368748903 CEST	49785	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.391992092 CEST	14444	49786	51.15.54.102	192.168.2.6
Sep 20, 2021 16:17:52.392168045 CEST	49786	14444	192.168.2.6	51.15.54.102
Sep 20, 2021 16:17:52.408998966 CEST	10128	49780	54.188.223.206	192.168.2.6
Sep 20, 2021 16:17:52.409193993 CEST	49780	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:52.413172007 CEST	14444	49764	139.99.102.73	192.168.2.6
Sep 20, 2021 16:17:52.416878939 CEST	14444	49771	139.99.156.30	192.168.2.6
Sep 20, 2021 16:17:52.417114019 CEST	49771	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:52.445516109 CEST	14444	49777	192.99.69.170	192.168.2.6
Sep 20, 2021 16:17:52.478595972 CEST	10128	49778	18.180.72.219	192.168.2.6
Sep 20, 2021 16:17:52.478776932 CEST	49778	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:52.479053974 CEST	10128	49773	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.479249954 CEST	10128	49773	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.481148005 CEST	49773	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.497462988 CEST	10128	49761	54.255.104.167	192.168.2.6
Sep 20, 2021 16:17:52.500452995 CEST	49773	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.504730940 CEST	49783	14444	192.168.2.6	151.80.144.188
Sep 20, 2021 16:17:52.520884037 CEST	14444	49762	139.162.112.195	192.168.2.6
Sep 20, 2021 16:17:52.534373045 CEST	14444	49783	151.80.144.188	192.168.2.6
Sep 20, 2021 16:17:52.538832903 CEST	49783	14444	192.168.2.6	151.80.144.188
Sep 20, 2021 16:17:52.544931889 CEST	49774	14444	192.168.2.6	45.76.65.223
Sep 20, 2021 16:17:52.552155972 CEST	49784	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.553210974 CEST	49785	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.553215981 CEST	49776	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.553536892 CEST	49786	14444	192.168.2.6	51.15.54.102
Sep 20, 2021 16:17:52.554349899 CEST	49780	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:52.560213089 CEST	49778	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:52.561534882 CEST	49771	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:52.573821068 CEST	14444	49777	192.99.69.170	192.168.2.6
Sep 20, 2021 16:17:52.573916912 CEST	49777	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.574265003 CEST	10128	49784	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.574376106 CEST	49784	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.575391054 CEST	10128	49785	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.575488091 CEST	49785	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.576670885 CEST	49777	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.586025953 CEST	49787	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.603434086 CEST	14444	49786	51.15.54.102	192.168.2.6
Sep 20, 2021 16:17:52.604995012 CEST	49788	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.607436895 CEST	14444	49786	51.15.54.102	192.168.2.6
Sep 20, 2021 16:17:52.607533932 CEST	49786	14444	192.168.2.6	51.15.54.102
Sep 20, 2021 16:17:52.608247042 CEST	10128	49787	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.608385086 CEST	49787	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.614157915 CEST	49787	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.621543884 CEST	49789	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.624202013 CEST	49790	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.636483908 CEST	10128	49787	195.201.124.214	192.168.2.6
Sep 20, 2021 16:17:52.636687994 CEST	49787	10128	192.168.2.6	195.201.124.214
Sep 20, 2021 16:17:52.639036894 CEST	10128	49773	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.681196928 CEST	14444	49777	192.99.69.170	192.168.2.6
Sep 20, 2021 16:17:52.691720963 CEST	10128	49776	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.691771984 CEST	10128	49776	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.691895962 CEST	49776	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.693979979 CEST	49776	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.705698967 CEST	14444	49774	45.76.65.223	192.168.2.6
Sep 20, 2021 16:17:52.711085081 CEST	14444	49764	139.99.102.73	192.168.2.6
Sep 20, 2021 16:17:52.711220980 CEST	49764	14444	192.168.2.6	139.99.102.73
Sep 20, 2021 16:17:52.711536884 CEST	49764	14444	192.168.2.6	139.99.102.73
Sep 20, 2021 16:17:52.720571041 CEST	49791	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.736377001 CEST	14444	49790	192.99.69.170	192.168.2.6
Sep 20, 2021 16:17:52.736572027 CEST	49790	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.737924099 CEST	10128	49780	54.188.223.206	192.168.2.6
Sep 20, 2021 16:17:52.738282919 CEST	10128	49780	54.188.223.206	192.168.2.6
Sep 20, 2021 16:17:52.738415956 CEST	49780	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:52.739923000 CEST	49780	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:52.761229038 CEST	10128	49789	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.767771006 CEST	10128	49788	54.255.104.167	192.168.2.6
Sep 20, 2021 16:17:52.768254042 CEST	49789	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.768265963 CEST	49788	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.789037943 CEST	49790	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.790163040 CEST	49789	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.792912006 CEST	49792	14444	192.168.2.6	139.99.102.71
Sep 20, 2021 16:17:52.793332100 CEST	49788	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.811856031 CEST	10128	49778	18.180.72.219	192.168.2.6
Sep 20, 2021 16:17:52.814977884 CEST	10128	49778	18.180.72.219	192.168.2.6
Sep 20, 2021 16:17:52.815205097 CEST	49778	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:52.817315102 CEST	49778	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:52.829108953 CEST	14444	49771	139.99.156.30	192.168.2.6
Sep 20, 2021 16:17:52.833894014 CEST	10128	49776	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.834604979 CEST	49793	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:52.844989061 CEST	14444	49774	45.76.65.223	192.168.2.6
Sep 20, 2021 16:17:52.845083952 CEST	49774	14444	192.168.2.6	45.76.65.223
Sep 20, 2021 16:17:52.848684072 CEST	49774	14444	192.168.2.6	45.76.65.223
Sep 20, 2021 16:17:52.860451937 CEST	10128	49791	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.860632896 CEST	49791	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.890803099 CEST	14444	49764	139.99.102.73	192.168.2.6
Sep 20, 2021 16:17:52.900564909 CEST	14444	49790	192.99.69.170	192.168.2.6
Sep 20, 2021 16:17:52.900692940 CEST	49790	14444	192.168.2.6	192.99.69.170
Sep 20, 2021 16:17:52.923387051 CEST	10128	49780	54.188.223.206	192.168.2.6
Sep 20, 2021 16:17:52.928874969 CEST	10128	49789	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:52.929052114 CEST	49789	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.932750940 CEST	49791	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:52.945130110 CEST	49794	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:52.955575943 CEST	10128	49788	54.255.104.167	192.168.2.6
Sep 20, 2021 16:17:52.955672026 CEST	49788	10128	192.168.2.6	54.255.104.167
Sep 20, 2021 16:17:52.970412016 CEST	14444	49792	139.99.102.71	192.168.2.6
Sep 20, 2021 16:17:52.970623970 CEST	49792	14444	192.168.2.6	139.99.102.71
Sep 20, 2021 16:17:52.972738981 CEST	49792	14444	192.168.2.6	139.99.102.71
Sep 20, 2021 16:17:52.974052906 CEST	49795	14444	192.168.2.6	207.246.100.198
Sep 20, 2021 16:17:53.003247023 CEST	14444	49762	139.162.112.195	192.168.2.6
Sep 20, 2021 16:17:53.003439903 CEST	49762	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:53.004786968 CEST	49762	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:53.009660006 CEST	14444	49774	45.76.65.223	192.168.2.6
Sep 20, 2021 16:17:53.011285067 CEST	10128	49793	54.188.223.206	192.168.2.6
Sep 20, 2021 16:17:53.014724016 CEST	49793	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:53.027707100 CEST	49793	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:53.036449909 CEST	49796	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:53.069094896 CEST	10128	49778	18.180.72.219	192.168.2.6
Sep 20, 2021 16:17:53.072335958 CEST	10128	49791	18.210.126.40	192.168.2.6
Sep 20, 2021 16:17:53.072487116 CEST	49791	10128	192.168.2.6	18.210.126.40
Sep 20, 2021 16:17:53.143088102 CEST	14444	49795	207.246.100.198	192.168.2.6
Sep 20, 2021 16:17:53.143183947 CEST	49795	14444	192.168.2.6	207.246.100.198
Sep 20, 2021 16:17:53.143737078 CEST	49795	14444	192.168.2.6	207.246.100.198
Sep 20, 2021 16:17:53.150230885 CEST	14444	49792	139.99.102.71	192.168.2.6
Sep 20, 2021 16:17:53.150669098 CEST	49792	14444	192.168.2.6	139.99.102.71
Sep 20, 2021 16:17:53.161814928 CEST	14444	49771	139.99.156.30	192.168.2.6
Sep 20, 2021 16:17:53.161936045 CEST	49771	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:53.176122904 CEST	49771	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:53.192399025 CEST	10128	49794	18.180.72.219	192.168.2.6
Sep 20, 2021 16:17:53.192560911 CEST	49794	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:53.195945024 CEST	49794	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:53.207277060 CEST	10128	49793	54.188.223.206	192.168.2.6
Sep 20, 2021 16:17:53.207432985 CEST	49793	10128	192.168.2.6	54.188.223.206
Sep 20, 2021 16:17:53.216011047 CEST	49797	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:53.283715963 CEST	14444	49762	139.162.112.195	192.168.2.6
Sep 20, 2021 16:17:53.314872980 CEST	14444	49795	207.246.100.198	192.168.2.6
Sep 20, 2021 16:17:53.316987038 CEST	49795	14444	192.168.2.6	207.246.100.198
Sep 20, 2021 16:17:53.364274025 CEST	14444	49796	139.162.112.195	192.168.2.6
Sep 20, 2021 16:17:53.364491940 CEST	49796	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:53.373915911 CEST	49796	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:53.443991899 CEST	10128	49794	18.180.72.219	192.168.2.6
Sep 20, 2021 16:17:53.444020987 CEST	14444	49771	139.99.156.30	192.168.2.6
Sep 20, 2021 16:17:53.444216967 CEST	49794	10128	192.168.2.6	18.180.72.219
Sep 20, 2021 16:17:53.485385895 CEST	14444	49797	139.99.156.30	192.168.2.6
Sep 20, 2021 16:17:53.485847950 CEST	49797	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:53.498188019 CEST	49797	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:53.644325018 CEST	14444	49796	139.162.112.195	192.168.2.6
Sep 20, 2021 16:17:53.710896015 CEST	14444	49796	139.162.112.195	192.168.2.6
Sep 20, 2021 16:17:53.711175919 CEST	49796	14444	192.168.2.6	139.162.112.195
Sep 20, 2021 16:17:53.763684988 CEST	49798	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.767709017 CEST	14444	49797	139.99.156.30	192.168.2.6
Sep 20, 2021 16:17:53.771138906 CEST	49797	14444	192.168.2.6	139.99.156.30
Sep 20, 2021 16:17:53.834419012 CEST	2222	49798	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:53.834613085 CEST	49798	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.835741043 CEST	49798	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.856431007 CEST	2222	49798	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:53.856477022 CEST	2222	49798	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:53.856547117 CEST	49798	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.857264042 CEST	49798	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.858444929 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.883502007 CEST	2222	49798	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:53.883536100 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:53.883824110 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.891510010 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:17:53.961555004 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:53.961602926 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:17:54.108755112 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:09.006793022 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:09.031537056 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:18:24.075234890 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:18:24.075387001 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:24.095772028 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:24.114953995 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:18:39.174562931 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:18:39.174747944 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:39.196208954 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:39.215625048 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:18:42.069931984 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:18:42.211564064 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:57.097727060 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:18:57.116755962 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:12.198472977 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:12.198647022 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:12.200865984 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:12.219885111 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:27.302557945 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:27.302675009 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:27.311629057 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:27.330636978 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:42.408170938 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:42.408369064 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:42.416271925 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:42.440712929 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:44.489917994 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:44.508955002 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:44.515300989 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:19:44.614588976 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:59.717089891 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:19:59.738501072 CEST	2222	49799	51.89.96.41	192.168.2.6
Sep 20, 2021 16:20:14.834855080 CEST	49799	2222	192.168.2.6	51.89.96.41
Sep 20, 2021 16:20:14.860850096 CEST	2222	49799	51.89.96.41	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 20, 2021 16:16:52.690994024 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:52.716610909 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:53.202148914 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:53.221410036 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:53.882023096 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:53.908582926 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:54.443977118 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:54.466253042 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:55.081995964 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:55.101425886 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:55.120183945 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:55.139838934 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:55.738073111 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:55.762558937 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:56.322972059 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:56.340677023 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:56.789344072 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:56.809426069 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:57.846765041 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:57.865994930 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:58.355138063 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:58.379867077 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:59.004910946 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:59.023938894 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 20, 2021 16:16:59.559504986 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:16:59.580396891 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:00.161885977 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:00.183552980 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:00.712143898 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:00.731367111 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:01.225557089 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:01.244127035 CEST	53	49694	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:04.723160028 CEST	54982	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:04.742355108 CEST	53	54982	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:29.368942976 CEST	50010	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:29.388577938 CEST	53	50010	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:51.903198957 CEST	63718	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:51.934108973 CEST	53	63718	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:51.947235107 CEST	62116	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:51.969907999 CEST	53	62116	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:51.994895935 CEST	63816	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.003196001 CEST	55014	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.018109083 CEST	53	63816	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.025985956 CEST	53	55014	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.051062107 CEST	62208	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.070298910 CEST	57574	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.074810028 CEST	53	62208	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.077537060 CEST	51818	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.086899042 CEST	56628	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.092935085 CEST	53	57574	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.097189903 CEST	60778	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.104028940 CEST	53	51818	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.110338926 CEST	53	56628	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.111187935 CEST	53799	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.119496107 CEST	53	60778	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.126595020 CEST	54683	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.136374950 CEST	59329	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.137234926 CEST	53	53799	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.150861025 CEST	64021	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.153669119 CEST	53	54683	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.159672976 CEST	53	59329	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.164228916 CEST	56129	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.175367117 CEST	58177	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.180890083 CEST	50700	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.182756901 CEST	53	64021	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.185822964 CEST	54069	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.186543941 CEST	61178	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.189826012 CEST	53	56129	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.194297075 CEST	57017	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.198137999 CEST	53	58177	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.207367897 CEST	53	50700	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.208287001 CEST	53	54069	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.210130930 CEST	53	61178	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.216962099 CEST	53	57017	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.260853052 CEST	56327	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.268893957 CEST	50243	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.279581070 CEST	62055	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.286338091 CEST	53	56327	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.286393881 CEST	61249	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.290338039 CEST	65252	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.292814970 CEST	53	50243	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.303519964 CEST	53	62055	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.308511972 CEST	53	65252	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.308804989 CEST	53	61249	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.553639889 CEST	64367	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.573263884 CEST	55066	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.580248117 CEST	53	64367	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.582072973 CEST	60211	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.593519926 CEST	56570	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.602947950 CEST	53	55066	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.609555960 CEST	53	60211	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.616808891 CEST	53	56570	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.699759007 CEST	58454	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.717638969 CEST	55180	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.719399929 CEST	53	58454	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.741450071 CEST	53	55180	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.794611931 CEST	58721	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.821621895 CEST	53	58721	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.829865932 CEST	57691	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.851711035 CEST	53	57691	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:52.944770098 CEST	52943	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:52.967212915 CEST	53	52943	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:53.011312962 CEST	59489	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:53.033525944 CEST	53	59489	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:53.188441992 CEST	64022	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:53.211309910 CEST	53	64022	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:53.710664034 CEST	64023	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:53.733613968 CEST	53	64023	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:53.736651897 CEST	64024	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:53.756797075 CEST	53	64024	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:55.433001995 CEST	60023	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:55.466562986 CEST	53	60023	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:56.088000059 CEST	57193	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:56.111979961 CEST	53	57193	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:56.724848032 CEST	50248	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:56.746889114 CEST	53	50248	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:57.080260038 CEST	64413	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:57.106569052 CEST	53	64413	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:57.659800053 CEST	60429	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:57.683654070 CEST	53	60429	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:58.107853889 CEST	60345	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:58.129864931 CEST	53	60345	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:58.995580912 CEST	58730	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:59.051291943 CEST	53	58730	8.8.8.8	192.168.2.6
Sep 20, 2021 16:17:59.946217060 CEST	53830	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:17:59.966351032 CEST	53	53830	8.8.8.8	192.168.2.6
Sep 20, 2021 16:18:00.790568113 CEST	57226	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:18:00.810148954 CEST	53	57226	8.8.8.8	192.168.2.6
Sep 20, 2021 16:18:01.250684977 CEST	57880	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:18:01.270885944 CEST	53	57880	8.8.8.8	192.168.2.6
Sep 20, 2021 16:18:19.175335884 CEST	60850	53	192.168.2.6	8.8.8.8
Sep 20, 2021 16:18:19.196850061 CEST	53	60850	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 20, 2021 16:17:51.903198957 CEST	192.168.2.6	8.8.8.8	0x1ec2	Standard query (0)	sg.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:51.947235107 CEST	192.168.2.6	8.8.8.8	0xd50c	Standard query (0)	xmr-jp1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:51.994895935 CEST	192.168.2.6	8.8.8.8	0xe936	Standard query (0)	xmr-asia1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.003196001 CEST	192.168.2.6	8.8.8.8	0x6567	Standard query (0)	xmr.2miners.com	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.051062107 CEST	192.168.2.6	8.8.8.8	0x28	Standard query (0)	proxycenter.geekgalaxy.com	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.070298910 CEST	192.168.2.6	8.8.8.8	0xdde5	Standard query (0)	xmr-eu2.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.077537060 CEST	192.168.2.6	8.8.8.8	0x991c	Standard query (0)	de.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.086899042 CEST	192.168.2.6	8.8.8.8	0xad2c	Standard query (0)	xmr-eu1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.097189903 CEST	192.168.2.6	8.8.8.8	0x4009	Standard query (0)	xmr-au1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.111187935 CEST	192.168.2.6	8.8.8.8	0x3bb6	Standard query (0)	fi.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.126595020 CEST	192.168.2.6	8.8.8.8	0xfe69	Standard query (0)	us-oh.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.136374950 CEST	192.168.2.6	8.8.8.8	0x3314	Standard query (0)	xmr-us-west1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.150861025 CEST	192.168.2.6	8.8.8.8	0x8660	Standard query (0)	gulf.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.164228916 CEST	192.168.2.6	8.8.8.8	0xb83f	Standard query (0)	us-va.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.175367117 CEST	192.168.2.6	8.8.8.8	0xf765	Standard query (0)	xmr-us-east1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.180890083 CEST	192.168.2.6	8.8.8.8	0x16ab	Standard query (0)	us-or.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.185822964 CEST	192.168.2.6	8.8.8.8	0x3f15	Standard query (0)	jp.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.186543941 CEST	192.168.2.6	8.8.8.8	0xd77e	Standard query (0)	fr.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.194297075 CEST	192.168.2.6	8.8.8.8	0x70de	Standard query (0)	xmr.2miners.com	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.260853052 CEST	192.168.2.6	8.8.8.8	0xceb0	Standard query (0)	de.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.268893957 CEST	192.168.2.6	8.8.8.8	0x8f3a	Standard query (0)	xmr-eu2.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.279581070 CEST	192.168.2.6	8.8.8.8	0xc707	Standard query (0)	fi.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.286393881 CEST	192.168.2.6	8.8.8.8	0x12ed	Standard query (0)	xmr-eu1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.290338039 CEST	192.168.2.6	8.8.8.8	0x789e	Standard query (0)	gulf.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.553639889 CEST	192.168.2.6	8.8.8.8	0xb3d3	Standard query (0)	fr.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.573263884 CEST	192.168.2.6	8.8.8.8	0xb540	Standard query (0)	sg.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.582072973 CEST	192.168.2.6	8.8.8.8	0xb036	Standard query (0)	us-oh.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.593519926 CEST	192.168.2.6	8.8.8.8	0xd01c	Standard query (0)	xmr-us-east1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.699759007 CEST	192.168.2.6	8.8.8.8	0x3c90	Standard query (0)	us-va.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.717638969 CEST	192.168.2.6	8.8.8.8	0xa6ab	Standard query (0)	xmr-asia1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.794611931 CEST	192.168.2.6	8.8.8.8	0xa53f	Standard query (0)	us-or.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.829865932 CEST	192.168.2.6	8.8.8.8	0xff1d	Standard query (0)	jp.moneroocean.stream	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.944770098 CEST	192.168.2.6	8.8.8.8	0x9c32	Standard query (0)	xmr-us-west1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.011312962 CEST	192.168.2.6	8.8.8.8	0x7b3c	Standard query (0)	xmr-jp1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.188441992 CEST	192.168.2.6	8.8.8.8	0xb719	Standard query (0)	xmr-au1.nanopool.org	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.710664034 CEST	192.168.2.6	8.8.8.8	0x5401	Standard query (0)	xmr.2miners.com	28	IN (0x0001)
Sep 20, 2021 16:17:53.736651897 CEST	192.168.2.6	8.8.8.8	0x4cc1	Standard query (0)	xmr.2miners.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 20, 2021 16:17:51.934108973 CEST	8.8.8.8	192.168.2.6	0x1ec2	No error (0)	sg.moneroocean.stream		54.255.104.167	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:51.969907999 CEST	8.8.8.8	192.168.2.6	0xd50c	No error (0)	xmr-jp1.nanopool.org		139.162.112.195	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:51.969907999 CEST	8.8.8.8	192.168.2.6	0xd50c	No error (0)	xmr-jp1.nanopool.org		172.105.211.250	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:51.969907999 CEST	8.8.8.8	192.168.2.6	0xd50c	No error (0)	xmr-jp1.nanopool.org		139.162.81.90	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.102.73	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.102.71	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.102.74	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		103.3.62.64	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.102.70	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		172.104.165.191	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.101.198	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.101.197	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.101.232	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.018109083 CEST	8.8.8.8	192.168.2.6	0xe936	No error (0)	xmr-asia1.nanopool.org		139.99.102.72	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.025985956 CEST	8.8.8.8	192.168.2.6	0x6567	No error (0)	xmr.2miners.com		51.89.96.41	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.074810028 CEST	8.8.8.8	192.168.2.6	0x28	No error (0)	proxycenter.geekgalaxy.com		51.83.61.76	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.092935085 CEST	8.8.8.8	192.168.2.6	0xdde5	No error (0)	xmr-eu2.nanopool.org		51.255.34.79	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.092935085 CEST	8.8.8.8	192.168.2.6	0xdde5	No error (0)	xmr-eu2.nanopool.org		51.255.34.80	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.092935085 CEST	8.8.8.8	192.168.2.6	0xdde5	No error (0)	xmr-eu2.nanopool.org		51.15.67.17	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.092935085 CEST	8.8.8.8	192.168.2.6	0xdde5	No error (0)	xmr-eu2.nanopool.org		151.80.144.188	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.092935085 CEST	8.8.8.8	192.168.2.6	0xdde5	No error (0)	xmr-eu2.nanopool.org		51.15.55.100	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.092935085 CEST	8.8.8.8	192.168.2.6	0xdde5	No error (0)	xmr-eu2.nanopool.org		213.32.74.157	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.092935085 CEST	8.8.8.8	192.168.2.6	0xdde5	No error (0)	xmr-eu2.nanopool.org		51.15.55.162	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.104028940 CEST	8.8.8.8	192.168.2.6	0x991c	No error (0)	de.moneroocean.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		185.71.66.31	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.68.143.81	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.15.54.102	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.83.33.228	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.15.69.136	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		135.125.238.108	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.255.34.118	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.15.65.182	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.15.58.224	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		51.15.78.68	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		217.182.169.148	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.110338926 CEST	8.8.8.8	192.168.2.6	0xad2c	No error (0)	xmr-eu1.nanopool.org		46.105.31.147	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.119496107 CEST	8.8.8.8	192.168.2.6	0x4009	No error (0)	xmr-au1.nanopool.org		139.99.156.30	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.137234926 CEST	8.8.8.8	192.168.2.6	0x3bb6	No error (0)	fi.moneroocean.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.153669119 CEST	8.8.8.8	192.168.2.6	0xfe69	No error (0)	us-oh.moneroocean.stream		18.210.126.40	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.159672976 CEST	8.8.8.8	192.168.2.6	0x3314	No error (0)	xmr-us-west1.nanopool.org		45.76.65.223	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.159672976 CEST	8.8.8.8	192.168.2.6	0x3314	No error (0)	xmr-us-west1.nanopool.org		149.28.212.250	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.159672976 CEST	8.8.8.8	192.168.2.6	0x3314	No error (0)	xmr-us-west1.nanopool.org		66.42.105.146	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.159672976 CEST	8.8.8.8	192.168.2.6	0x3314	No error (0)	xmr-us-west1.nanopool.org		104.238.180.207	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.159672976 CEST	8.8.8.8	192.168.2.6	0x3314	No error (0)	xmr-us-west1.nanopool.org		207.246.100.198	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.159672976 CEST	8.8.8.8	192.168.2.6	0x3314	No error (0)	xmr-us-west1.nanopool.org		45.32.71.82	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.182756901 CEST	8.8.8.8	192.168.2.6	0x8660	No error (0)	gulf.moneroocean.stream	monerooceans.stream		CNAME (Canonical name)	IN (0x0001)
Sep 20, 2021 16:17:52.182756901 CEST	8.8.8.8	192.168.2.6	0x8660	No error (0)	monerooceans.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.189826012 CEST	8.8.8.8	192.168.2.6	0xb83f	No error (0)	us-va.moneroocean.stream		18.210.126.40	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.198137999 CEST	8.8.8.8	192.168.2.6	0xf765	No error (0)	xmr-us-east1.nanopool.org		192.99.69.170	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.198137999 CEST	8.8.8.8	192.168.2.6	0xf765	No error (0)	xmr-us-east1.nanopool.org		144.217.14.109	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.198137999 CEST	8.8.8.8	192.168.2.6	0xf765	No error (0)	xmr-us-east1.nanopool.org		142.44.243.6	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.198137999 CEST	8.8.8.8	192.168.2.6	0xf765	No error (0)	xmr-us-east1.nanopool.org		142.44.242.100	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.198137999 CEST	8.8.8.8	192.168.2.6	0xf765	No error (0)	xmr-us-east1.nanopool.org		144.217.14.139	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.207367897 CEST	8.8.8.8	192.168.2.6	0x16ab	No error (0)	us-or.moneroocean.stream		54.188.223.206	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.208287001 CEST	8.8.8.8	192.168.2.6	0x3f15	No error (0)	jp.moneroocean.stream		18.180.72.219	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.210130930 CEST	8.8.8.8	192.168.2.6	0xd77e	No error (0)	fr.moneroocean.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.216962099 CEST	8.8.8.8	192.168.2.6	0x70de	No error (0)	xmr.2miners.com		51.89.96.41	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.286338091 CEST	8.8.8.8	192.168.2.6	0xceb0	No error (0)	de.moneroocean.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.292814970 CEST	8.8.8.8	192.168.2.6	0x8f3a	No error (0)	xmr-eu2.nanopool.org		151.80.144.188	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.292814970 CEST	8.8.8.8	192.168.2.6	0x8f3a	No error (0)	xmr-eu2.nanopool.org		51.255.34.79	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.292814970 CEST	8.8.8.8	192.168.2.6	0x8f3a	No error (0)	xmr-eu2.nanopool.org		213.32.74.157	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.292814970 CEST	8.8.8.8	192.168.2.6	0x8f3a	No error (0)	xmr-eu2.nanopool.org		51.15.55.162	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.292814970 CEST	8.8.8.8	192.168.2.6	0x8f3a	No error (0)	xmr-eu2.nanopool.org		51.15.55.100	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.292814970 CEST	8.8.8.8	192.168.2.6	0x8f3a	No error (0)	xmr-eu2.nanopool.org		51.255.34.80	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.292814970 CEST	8.8.8.8	192.168.2.6	0x8f3a	No error (0)	xmr-eu2.nanopool.org		51.15.67.17	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.303519964 CEST	8.8.8.8	192.168.2.6	0xc707	No error (0)	fi.moneroocean.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308511972 CEST	8.8.8.8	192.168.2.6	0x789e	No error (0)	gulf.moneroocean.stream	monerooceans.stream		CNAME (Canonical name)	IN (0x0001)
Sep 20, 2021 16:17:52.308511972 CEST	8.8.8.8	192.168.2.6	0x789e	No error (0)	monerooceans.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.15.54.102	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		135.125.238.108	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.15.78.68	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.255.34.118	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.83.33.228	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.15.65.182	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.68.143.81	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.15.58.224	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		217.182.169.148	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		46.105.31.147	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		51.15.69.136	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.308804989 CEST	8.8.8.8	192.168.2.6	0x12ed	No error (0)	xmr-eu1.nanopool.org		185.71.66.31	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.580248117 CEST	8.8.8.8	192.168.2.6	0xb3d3	No error (0)	fr.moneroocean.stream		195.201.124.214	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.602947950 CEST	8.8.8.8	192.168.2.6	0xb540	No error (0)	sg.moneroocean.stream		54.255.104.167	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.609555960 CEST	8.8.8.8	192.168.2.6	0xb036	No error (0)	us-oh.moneroocean.stream		18.210.126.40	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.616808891 CEST	8.8.8.8	192.168.2.6	0xd01c	No error (0)	xmr-us-east1.nanopool.org		192.99.69.170	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.616808891 CEST	8.8.8.8	192.168.2.6	0xd01c	No error (0)	xmr-us-east1.nanopool.org		142.44.242.100	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.616808891 CEST	8.8.8.8	192.168.2.6	0xd01c	No error (0)	xmr-us-east1.nanopool.org		144.217.14.109	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.616808891 CEST	8.8.8.8	192.168.2.6	0xd01c	No error (0)	xmr-us-east1.nanopool.org		142.44.243.6	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.616808891 CEST	8.8.8.8	192.168.2.6	0xd01c	No error (0)	xmr-us-east1.nanopool.org		144.217.14.139	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.719399929 CEST	8.8.8.8	192.168.2.6	0x3c90	No error (0)	us-va.moneroocean.stream		18.210.126.40	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.102.71	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.101.232	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.102.70	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.102.72	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		172.104.165.191	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.101.198	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.102.74	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.102.73	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		103.3.62.64	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.741450071 CEST	8.8.8.8	192.168.2.6	0xa6ab	No error (0)	xmr-asia1.nanopool.org		139.99.101.197	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.821621895 CEST	8.8.8.8	192.168.2.6	0xa53f	No error (0)	us-or.moneroocean.stream		54.188.223.206	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.851711035 CEST	8.8.8.8	192.168.2.6	0xff1d	No error (0)	jp.moneroocean.stream		18.180.72.219	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.967212915 CEST	8.8.8.8	192.168.2.6	0x9c32	No error (0)	xmr-us-west1.nanopool.org		207.246.100.198	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.967212915 CEST	8.8.8.8	192.168.2.6	0x9c32	No error (0)	xmr-us-west1.nanopool.org		66.42.105.146	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.967212915 CEST	8.8.8.8	192.168.2.6	0x9c32	No error (0)	xmr-us-west1.nanopool.org		45.76.65.223	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.967212915 CEST	8.8.8.8	192.168.2.6	0x9c32	No error (0)	xmr-us-west1.nanopool.org		149.28.212.250	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.967212915 CEST	8.8.8.8	192.168.2.6	0x9c32	No error (0)	xmr-us-west1.nanopool.org		104.238.180.207	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:52.967212915 CEST	8.8.8.8	192.168.2.6	0x9c32	No error (0)	xmr-us-west1.nanopool.org		45.32.71.82	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.033525944 CEST	8.8.8.8	192.168.2.6	0x7b3c	No error (0)	xmr-jp1.nanopool.org		139.162.112.195	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.033525944 CEST	8.8.8.8	192.168.2.6	0x7b3c	No error (0)	xmr-jp1.nanopool.org		172.105.211.250	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.033525944 CEST	8.8.8.8	192.168.2.6	0x7b3c	No error (0)	xmr-jp1.nanopool.org		139.162.81.90	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.211309910 CEST	8.8.8.8	192.168.2.6	0xb719	No error (0)	xmr-au1.nanopool.org		139.99.156.30	A (IP address)	IN (0x0001)
Sep 20, 2021 16:17:53.733613968 CEST	8.8.8.8	192.168.2.6	0x5401	No error (0)	xmr.2miners.com			28	IN (0x0001)
Sep 20, 2021 16:17:53.756797075 CEST	8.8.8.8	192.168.2.6	0x4cc1	No error (0)	xmr.2miners.com		51.89.96.41	A (IP address)	IN (0x0001)

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49767	51.83.61.76	80	C:\Users\user\Desktop\dllhost.exe

Timestamp	kBytes transferred	Direction	Data
Sep 20, 2021 16:17:52.167704105 CEST	1065	OUT	Data Raw: 16 03 01 01 11 01 00 01 0d 03 03 81 34 0f c0 5d 8c 8c 57 15 e7 2d 02 c4 c6 c8 24 71 c4 ed 9a fb 72 3c 24 7b fb 7a 56 0e 7e 04 fe 20 4d dc 1f c9 31 48 39 ae 70 19 f8 81 07 75 4f ad 62 df 71 9d 2c 4d cb 7c fc 84 43 b3 43 b5 93 22 00 26 c0 2f c0 30 Data Ascii: 4]W-$qr<${zV~ M1H9puObq,M\|CC"&/0+,/5proxycenter.geekgalaxy.com+3&$
Sep 20, 2021 16:17:52.199449062 CEST	1070	IN	Data Raw: 16 03 03 00 7a 02 00 00 76 03 03 06 7f 2a 23 41 d6 39 a5 a1 4e 98 e8 af 37 74 95 56 1c e8 3f 76 08 e3 db cb be 88 a7 08 15 31 c2 20 4d dc 1f c9 31 48 39 ae 70 19 f8 81 07 75 4f ad 62 df 71 9d 2c 4d cb 7c fc 84 43 b3 43 b5 93 22 13 02 00 00 2e 00 Data Ascii: zv*#A9N7tV?v1 M1H9puObq,M\|CC".+3$ 5q$?z#PG&]yp.]/!&E6H_cHlr:x'H95Q;=)=oqylr\@]2H]&a
Sep 20, 2021 16:17:52.206331968 CEST	1072	OUT	Data Raw: 14 03 03 00 01 01 17 03 03 00 45 a1 f8 55 22 b1 bc 70 d3 6e 86 35 9f 6f d4 f6 52 af ea 79 3e e5 57 41 ab 0c 79 7d b0 a6 9c ab 69 7f 4a aa 6f 09 07 7a 98 63 cd 9d 8d 4e d1 d6 27 a6 f3 0d b0 40 f7 e9 12 c2 3e 08 21 5c c5 fa 61 d2 6f 71 dd 60 Data Ascii: EU"pn5oRy>WAy}iJozcN'@>!\aoq`
Sep 20, 2021 16:17:52.207072973 CEST	1072	OUT	Data Raw: 17 03 03 00 13 08 32 ef a4 79 8d a6 59 b2 b5 7b 75 98 63 3a 15 59 64 6c Data Ascii: 2yY{uc:Ydl
Sep 20, 2021 16:17:52.232741117 CEST	1075	IN	Data Raw: 17 03 03 00 ea 50 ce 86 8b 66 75 0d 7e 51 9c 49 a5 9d 76 55 93 36 63 08 93 96 48 49 49 f6 18 2d 56 ee 04 9b e3 d2 61 eb 99 80 84 99 e3 7f 64 3c 77 ab 3c b6 99 73 55 57 b9 4d 08 31 bc 78 d2 a5 73 ee 6f 2a 27 12 96 93 7b 2a bb fb 19 ff 6a 47 3e 40 Data Ascii: Pfu~QIvU6cHII-Vad<w<sUWM1xso'{jG>@)"paDd+{>WD-#`}bu0@B#w%}@QY;bhH72j_ugtxd8hZ@DeZL3(`s};)T&S<WT9$*-k

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: dllhost.exe PID: 2276 Parent PID: 5756

General

Start time:	16:17:21
Start date:	20/09/2021
Path:	C:\Users\user\Desktop\dllhost.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\dllhost.exe'
Imagebase:	0x7ff6e50b0000
File size:	67306240 bytes
MD5 hash:	FB4C1F5EC7701209F0A1DCD0726DC403
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nanominer, Description: Yara detected Nanominer, Source: 00000001.00000003.449048598.0000028FA8CD4000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5356 Parent PID: 2276

General

Start time:	16:17:30
Start date:	20/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report dllhost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Bitcoin Miner:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Packets