Play interactive tour
Edit tourWindows Analysis Report dngqoAXyDd.exe
Overview
General Information
| Sample Name: | dngqoAXyDd.exe |
| Analysis ID: | 516930 |
| MD5: | 0afbb383c5cea9f11202d572141bb0f4 |
| SHA1: | 148266112b25087f10ac1124ea32630e48fb0bd9 |
| SHA256: | 6a910ec8055b3844e3dd14c7af08a68110abc9395a88ab9199e69ed07be27210 |
| Infos: | |
Most interesting Screenshot:  | |
Detection
TrickBot
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Trickbot
Multi AV Scanner detection for submitted file
Found detection on Joe Sandbox Cloud Basic with higher score
Sigma detected: Suspect Svchost Activity
Writes to foreign memory regions
Hijacks the control flow in another process
May check the online IP address of the machine
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Sigma detected: Suspicious Svchost Process
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Tries to load missing DLLs
Contains functionality to query network adapater information
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
Threatname: Trickbot |
|---|
{"ver": "100019", "gtag": "top147", "servs": ["65.152.201.203:443", "185.56.175.122:443", "46.99.175.217:443", "179.189.229.254:443", "46.99.175.149:443", "181.129.167.82:443", "216.166.148.187:443", "46.99.188.223:443", "128.201.76.252:443", "62.99.79.77:443", "60.51.47.65:443", "24.162.214.166:443", "45.36.99.184:443", "97.83.40.67:443", "184.74.99.214:443", "103.105.254.17:443", "62.99.76.213:443", "82.159.149.52:443"], "autorun": ["pwgrabb", "pwgrabc"], "ecc_key": "RUNTMzAAAABbfmkJRvwyw7iFkX40hL2HwsUeOSZZZo0FRRWGkY6J1+gf3YKq13Ee4sY3Jb9/0myCr0MwzNK1K2l5yuY87nW29Q/yjMJG0ISDj0HNBC3G+ZGta6Oi9QkjCwnNGbw2hQ4="}Yara Overview |
|---|
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_TrickBot_4 | Yara detected Trickbot | Joe Security | ||
| JoeSecurity_Trickbot_1 | Yara detected Trickbot | Joe Security |
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Suspect Svchost Activity | Show sources | ||
| Source: | Author: David Burkett: | ||
| Sigma detected: Suspicious Svchost Process | Show sources | ||
| Source: | Author: Florian Roth: | ||
Jbx Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Found malware configuration | Show sources | ||
| Source: | Malware Configuration Extractor: | ||
| Yara detected Trickbot | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 3_2_000001767ECD0960 | |
| Source: | Code function: | 3_2_000001767ECC7120 | |
| Source: | Code function: | 3_2_000001767ECCFA20 | |
| Source: | Code function: | 3_2_000001767ECD3990 | |
| Source: | Code function: | 3_2_000001767ECC4D50 | |
| Source: | Code function: | 3_2_000001767ECCB520 | |
| Source: | Code function: | 3_2_000001767ECC0A00 | |
| Source: | Code function: | 3_2_000001767ECCFBA0 | |
| Source: | Code function: | 3_2_000001767ECCFBA0 | |
| Source: | Code function: | 3_2_000001767ECBA3B0 | |
| Source: | Code function: | 3_2_000001767ECD5F60 | |
| Source: | Code function: | 3_2_000001767ECBE320 | |
| Source: | Code function: | 3_2_000001767ECD5EC0 | |
| Source: | Code function: | 3_2_000001767ECB6EF0 | |
| Source: | Code function: | 3_2_000001767ECC4060 | |
| Source: | Code function: | 3_2_000001767ECC9460 | |
| Source: | Code function: | 3_2_000001767ECB4470 | |
| Source: | Code function: | 3_2_000001767ECB4470 | |
| Source: | Code function: | 3_2_000001767ECB2BC0 | |
| Source: | Code function: | 3_2_000001767ECB5BE0 | |
| Source: | Code function: | 3_2_000001767ECCE3F0 | |
Networking: | |
|---|
| Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) | Show sources | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| May check the online IP address of the machine | Show sources | ||
| Source: | DNS query: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
E-Banking Fraud: | |
|---|
| Yara detected Trickbot | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
System Summary: | |
|---|
| Found detection on Joe Sandbox Cloud Basic with higher score | Show sources | ||
| Source: | Joe Sandbox Cloud Basic: | Perma Link | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 1_2_0075911C | |
| Source: | Code function: | 1_2_0074C201 | |
| Source: | Code function: | 1_2_007582BD | |
| Source: | Code function: | 1_2_0075941B | |
| Source: | Code function: | 1_2_0074C5D3 | |
| Source: | Code function: | 1_2_007516DE | |
| Source: | Code function: | 1_2_0075880E | |
| Source: | Code function: | 1_2_0073C950 | |
| Source: | Code function: | 1_2_0074B9CE | |
| Source: | Code function: | 1_2_0074C9BB | |
| Source: | Code function: | 1_2_0075BBF1 | |
| Source: | Code function: | 1_2_00745C19 | |
| Source: | Code function: | 1_2_00757D6E | |
| Source: | Code function: | 1_2_00754D22 | |
| Source: | Code function: | 1_2_00759E7F | |
| Source: | Code function: | 1_2_0074BE63 | |
| Source: | Code function: | 1_2_00758EA1 | |
| Source: | Code function: | 1_2_02883168 | |
| Source: | Code function: | 3_2_000001767ECB14D0 | |
| Source: | Code function: | 3_2_000001767ECC88E0 | |
| Source: | Code function: | 3_2_000001767ECC1EA0 | |
| Source: | Code function: | 3_2_000001767ECC4260 | |
| Source: | Code function: | 3_2_000001767ECB7340 | |
| Source: | Code function: | 3_2_000001767ECBC750 | |
| Source: | Code function: | 3_2_000001767ECB8370 | |
| Source: | Code function: | 3_2_000001767ECB2F30 | |
| Source: | Code function: | 3_2_000001767ECD52C0 | |
| Source: | Code function: | 3_2_000001767ECB30AA | |
| Source: | Code function: | 3_2_000001767ECC51A0 | |
| Source: | Code function: | 3_2_000001767ECCED70 | |
| Source: | Code function: | 3_2_000001767ECCB920 | |
| Source: | Code function: | 3_2_000001767ECD4CF0 | |
| Source: | Code function: | 3_2_000001767ECC9A80 | |
| Source: | Code function: | 3_2_000001767ECBFE8E | |
| Source: | Code function: | 3_2_000001767ECC0A00 | |
| Source: | Code function: | 3_2_000001767ECB79D0 | |
| Source: | Code function: | 3_2_000001767ECC35D0 | |
| Source: | Code function: | 3_2_000001767ECD45D0 | |
| Source: | Code function: | 3_2_000001767ECC73A0 | |
| Source: | Code function: | 3_2_000001767ECB3BB0 | |
| Source: | Code function: | 3_2_000001767ECC7760 | |
| Source: | Code function: | 3_2_000001767ECD5F60 | |
| Source: | Code function: | 3_2_000001767ECBF700 | |
| Source: | Code function: | 3_2_000001767ECD4B10 | |
| Source: | Code function: | 3_2_000001767ECB4730 | |
| Source: | Code function: | 3_2_000001767ECC5AC0 | |
| Source: | Code function: | 3_2_000001767ECC7EE0 | |
| Source: | Code function: | 3_2_000001767ECCE47D | |
| Source: | Code function: | 3_2_000001767ECC740C | |
| Source: | Code function: | 3_2_000001767ECB1030 | |
| Source: | Code function: | 3_2_000001767ECD33D0 | |
| Source: | Code function: | 3_2_000001767ECC17F0 | |
| Source: | Code function: | 3_2_000001767ECCE3F0 | |
| Source: | Code function: | 3_2_000001767ECCC550 | |
| Source: | Code function: | 3_2_000001767ECC9CD0 | |
| Source: | Code function: | 3_2_000001767ECBC750 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 3_2_000001767ECBF3C0 | |
| Source: | System information queried: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Code function: | 1_2_00731E80 | |
| Source: | Process created: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 1_2_0073D0F2 | |
| Source: | Code function: | 1_2_00740094 | |
| Source: | Code function: | 1_2_00744438 | |
| Source: | Code function: | 1_2_0074CEEF | |
| Source: | Code function: | 1_2_028A049D | |
| Source: | Code function: | 3_2_000001767ECD6DD1 | |
| Source: | Code function: | 3_2_000001767ECCDF25 | |
| Source: | Code function: | 1_2_0074DD3C | |
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion: | |
|---|
| Found evasive API chain (trying to detect sleep duration tampering with parallel thread) | Show sources | ||
| Source: | Function Chain: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 3_2_000001767ECCADA0 | |
| Source: | Code function: | 3_2_000001767ECCFA20 | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 3_2_000001767ECD0960 | |
| Source: | Code function: | 3_2_000001767ECC7120 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 1_2_0074293C | |
| Source: | Code function: | 1_2_0074DD3C | |
| Source: | Code function: | 3_2_000001767ECCADA0 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 3_2_000001767ECCA280 | |
| Source: | Code function: | 1_2_0074676A | |
| Source: | Code function: | 1_2_0074293C | |
| Source: | Code function: | 1_2_0073CFF8 | |
HIPS / PFW / Operating System Protection Evasion: | |
|---|
| Writes to foreign memory regions | Show sources | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Hijacks the control flow in another process | Show sources | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 1_2_0074A134 | |
| Source: | Code function: | 1_2_0074A1F6 | |
| Source: | Code function: | 1_2_0074A220 | |
| Source: | Code function: | 1_2_0074A2C3 | |
| Source: | Code function: | 1_2_0074A287 | |
| Source: | Code function: | 1_2_00757650 | |
| Source: | Code function: | 1_2_007486AD | |
| Source: | Code function: | 1_2_00741742 | |
| Source: | Code function: | 1_2_00757918 | |
| Source: | Code function: | 1_2_00749D6C | |
| Source: | Code function: | 1_2_00749E61 | |
| Source: | Code function: | 1_2_00749F63 | |
| Source: | Code function: | 1_2_00749F08 | |
| Source: | Code function: | 1_2_00747022 | |
Stealing of Sensitive Information: | |
|---|
| Yara detected Trickbot | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Tries to harvest and steal browser information (history, passwords, etc) | Show sources | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
Remote Access Functionality: | |
|---|
| Yara detected Trickbot | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting1 | DLL Side-Loading1 | Access Token Manipulation1 | Masquerading1 | OS Credential Dumping1 | System Time Discovery1 | Remote Services | Archive Collected Data1 | Exfiltration Over Other Network Medium | Encrypted Channel11 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Native API11 | Boot or Logon Initialization Scripts | Process Injection212 | Disable or Modify Tools1 | LSASS Memory | Security Software Discovery21 | Remote Desktop Protocol | Data from Local System1 | Exfiltration Over Bluetooth | Ingress Tool Transfer3 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | DLL Side-Loading1 | Virtualization/Sandbox Evasion1 | Security Account Manager | Virtualization/Sandbox Evasion1 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Non-Application Layer Protocol4 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Access Token Manipulation1 | NTDS | Process Discovery3 | Distributed Component Object Model | Input Capture | Scheduled Transfer | Application Layer Protocol5 | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Process Injection212 | LSA Secrets | System Network Configuration Discovery11 | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | Deobfuscate/Decode Files or Information1 | Cached Domain Credentials | File and Directory Discovery2 | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Scripting1 | DCSync | System Information Discovery23 | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact | |
| Drive-by Compromise | Command and Scripting Interpreter | Scheduled Task/Job | Scheduled Task/Job | Obfuscated Files or Information3 | Proc Filesystem | Network Service Scanning | Shared Webroot | Credential API Hooking | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Application Layer Protocol | Downgrade to Insecure Protocols | Generate Fraudulent Advertising Revenue | |
| Exploit Public-Facing Application | PowerShell | At (Linux) | At (Linux) | DLL Side-Loading1 | /etc/passwd and /etc/shadow | System Network Connections Discovery | Software Deployment Tools | Data Staged | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | Web Protocols | Rogue Cellular Base Station | Data Destruction |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 27% | Virustotal | Browse | ||
| 29% | ReversingLabs | Win32.Trojan.Trickpak |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 2% | Virustotal | Browse |
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| 91.143.129.102.b.barracudacentral.org | 127.0.0.2 | true | false | high | |
| ip.anysrc.net | 116.203.16.95 | true | true |
| unknown |
| 91.143.129.102.zen.spamhaus.org | unknown | unknown | false | high | |
| 91.143.129.102.cbl.abuseat.org | unknown | unknown | false | high |
Contacted URLs |
|---|
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| true |
| unknown | |
| false |
| unknown | |
| true |
| unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 46.99.175.217 | unknown | Albania | 21246 | IPKO-ASAL | true | |
| 202.58.199.82 | unknown | Indonesia | 45701 | MILLENINDO-AS-IDInternetMadjuAbadMillenindoPTID | false | |
| 116.203.16.95 | ip.anysrc.net | Germany | 24940 | HETZNER-ASDE | true | |
| 24.45.255.9 | unknown | United States | 6128 | CABLE-NET-1US | false |
General Information |
|---|
| Joe Sandbox Version: | 34.0.0 Boulder Opal |
| Analysis ID: | 516930 |
| Start date: | 06.11.2021 |
| Start time: | 15:10:41 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 13m 21s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | dngqoAXyDd.exe |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301 |
| Run name: | Suspected Instruction Hammering |
| Number of analysed new started processes analysed: | 17 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@9/5@4/4 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| Time | Type | Description |
|---|---|---|
| 15:12:42 | API Interceptor | |
| 15:12:42 | API Interceptor | |
| 15:12:53 | Task Scheduler |
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 46.99.175.217 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| 116.203.16.95 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| ip.anysrc.net | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| IPKO-ASAL | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| MILLENINDO-AS-IDInternetMadjuAbadMillenindoPTID | Get hash | malicious | Browse |
| |
| HETZNER-ASDE | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 72a589da586844d7f0818ce684948eea | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 73728 |
| Entropy (8bit): | 3.758760013585961 |
| Encrypted: | false |
| SSDEEP: | 384:qGHsAH0UkOYBOYVOQ0fH8VnRMD+lEofbKWc9JqxYuiAAW2QBRW9TYVVox:pHO9FVISnSSlpDK9SiyBRCcS |
| MD5: | CFA95D988565672C785871A48B529F85 |
| SHA1: | 4D6BED615DFA00E1067E6F95F8EC6C210ADF96A7 |
| SHA-256: | 647D64A623FB1B62175441A0EF016F8B4479A64D620498644F15DD04FDFB3B24 |
| SHA-512: | 0CB69C41DBE7A482F87FAC27EDADC822928D21B6C238EBED2459CD1873B2181734CB67D3A38714C2BAB57FFAEE699CF5EBFF5ABFC3D291B6C36A8E71572CD402 |
| Malicious: | true |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 196608 |
| Entropy (8bit): | 2.7939534929445644 |
| Encrypted: | false |
| SSDEEP: | 3072:WdtXB1bOkrIyTbXtqdEfzcTj4dXEOfyy1PbvrGMO4m1byqTf9+:W/XB1bOkrIyTbXt0uzcTj4dXEOfyy1PM |
| MD5: | A61AE5E24545DE81357933EC21C03720 |
| SHA1: | 41D04544D69935A3FFA6FE1491CB6B14C88DF241 |
| SHA-256: | B450BDDD36650ACD377FFA71C4F86C787A30F731823C6836B8FE507E3F395874 |
| SHA-512: | 2DD70E34F92613AABCFAC17E6F9E853C674EA1FAA095E2425F8534B87B8C83388FF89A64361E873AF3534FA137907A72618EA2E46C2E61B809F8752ABC85F830 |
| Malicious: | true |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40960 |
| Entropy (8bit): | 0.8384034474405602 |
| Encrypted: | false |
| SSDEEP: | 48:13WB14fxcKzsIYICVEq8MX0D0HSFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:J2CdCn8MZyFlulGNxGt7KLyeymw |
| MD5: | 3486408AF6E5BFDBE15DEDDEFB834576 |
| SHA1: | 8118E27D74977C176BD305862105CE5F22AE10D8 |
| SHA-256: | 5B26EE9B1FF774148D102BD7594D4B31C4B004D05C42F72EF82B1C90362B2196 |
| SHA-512: | E2F45693DDBE1A42C6855439A394E1C00AE8EC81FDC4B8F1BC6EC37E93AE9389D0E0CCC3C4419572DD09371590384E859324F163BDFD462C2B1D4FF7F7ED1E73 |
| Malicious: | true |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 92160 |
| Entropy (8bit): | 1.3005883677497518 |
| Encrypted: | false |
| SSDEEP: | 192:hzUfJShWdeeH9JbMBlTJjnhtumz8t6B9/1Vumq:RUfJSeeY9qnh7z8Y/1Vumq |
| MD5: | 3F23D4F2F3E6A6A42711CE8A6EA39D65 |
| SHA1: | F49796333961BD19E2968B899D3B0043D735F1E9 |
| SHA-256: | C4042AA61D92BFDE8BF40B0462C71FBAE4434A3441532D46AA1CA7A5B0A91F41 |
| SHA-512: | 3D75DB430A6BA581EF0DA4A1DCF0010CE010D52E963AAAB38FD1A85DCAD431EC54DF5481C95C3F50E5A099DFC3ED724ABCBD7BFD8322544DBB007866815899A8 |
| Malicious: | true |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49966 |
| Entropy (8bit): | 6.092508919581415 |
| Encrypted: | false |
| SSDEEP: | 1536:L1xCTvIMnjgxmHRIibWBkkVbWiBMaJCJUWK:XfMnjgxOR5bEkkVbWiKa/ |
| MD5: | 7895CBEF8D4DB5C7C5035627E7FF9050 |
| SHA1: | 83D1052D418529848AE62221C3BA220AC752A3A6 |
| SHA-256: | 29949F5425B19175F2C4176490D60FC4F76687E9758DE8327CD30522115E23F8 |
| SHA-512: | 608C3C87D30EAE5FA0AA5FAB8D8DDA4E0F97C70FC647D7D34EC50EC6F0420FDCE62A14B8F42E372B696854500B7B03D598B6CC199ACA48A84A88B5081E6BE5AC |
| Malicious: | false |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 6.167416806599989 |
| TrID: |
|
| File name: | dngqoAXyDd.exe |
| File size: | 652800 |
| MD5: | 0afbb383c5cea9f11202d572141bb0f4 |
| SHA1: | 148266112b25087f10ac1124ea32630e48fb0bd9 |
| SHA256: | 6a910ec8055b3844e3dd14c7af08a68110abc9395a88ab9199e69ed07be27210 |
| SHA512: | 702447b6e1313224d4c8084f716d8d838090c7bd9fb3558c6ab4553ce3676bb5fe1c2ebde61e4ed8b7bb6d3d7f1dfd11c434e5e0f9b7baa2511a12fd1c501880 |
| SSDEEP: | 12288:AjX3XdmePk2BSPkno2voTFa24aZZTUQxIpTLY0E5pM:2HXgASPMNvoTFFjT8tLYNH |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u...u...u.......b.....&.....|...r...u...#.....'.G.......t...u...t.......t...Richu...................PE..L....(.a........... |
File Icon |
|---|
 | |
| Icon Hash: | 0000000000000000 |
Static PE Info |
|---|
General | |
|---|---|
| Entrypoint: | 0x40cfee |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | 32BIT_MACHINE, EXECUTABLE_IMAGE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
| Time Stamp: | 0x618528F1 [Fri Nov 5 12:52:01 2021 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 2a49715e49b2891839bf716e121ca434 |
Entrypoint Preview |
|---|
| Instruction |
|---|
| call 00007FD5E89A16B4h |
| jmp 00007FD5E899750Eh |
| cmp ecx, dword ptr [00443AD4h] |
| jne 00007FD5E8997684h |
| rep ret |
| jmp 00007FD5E89A173Bh |
| push eax |
| push dword ptr fs:[00000000h] |
| lea eax, dword ptr [esp+0Ch] |
| sub esp, dword ptr [esp+0Ch] |
| push ebx |
| push esi |
| push edi |
| mov dword ptr [eax], ebp |
| mov ebp, eax |
| mov eax, dword ptr [00443AD4h] |
| xor eax, ebp |
| push eax |
| push dword ptr [ebp-04h] |
| mov dword ptr [ebp-04h], FFFFFFFFh |
| lea eax, dword ptr [ebp-0Ch] |
| mov dword ptr fs:[00000000h], eax |
| ret |
| push eax |
| push dword ptr fs:[00000000h] |
| lea eax, dword ptr [esp+0Ch] |
| sub esp, dword ptr [esp+0Ch] |
| push ebx |
| push esi |
| push edi |
| mov dword ptr [eax], ebp |
| mov ebp, eax |
| mov eax, dword ptr [00443AD4h] |
| xor eax, ebp |
| push eax |
| mov dword ptr [ebp-10h], esp |
| push dword ptr [ebp-04h] |
| mov dword ptr [ebp-04h], FFFFFFFFh |
| lea eax, dword ptr [ebp-0Ch] |
| mov dword ptr fs:[00000000h], eax |
| ret |
| push eax |
| push dword ptr fs:[00000000h] |
| lea eax, dword ptr [esp+0Ch] |
| sub esp, dword ptr [esp+0Ch] |
| push ebx |
| push esi |
| push edi |
| mov dword ptr [eax], ebp |
| mov ebp, eax |
| mov eax, dword ptr [00443AD4h] |
| xor eax, ebp |
| push eax |
| mov dword ptr [ebp-10h], eax |
| push dword ptr [ebp-04h] |
| mov dword ptr [ebp-04h], FFFFFFFFh |
| lea eax, dword ptr [ebp-0Ch] |
| mov dword ptr fs:[00000000h], eax |
| ret |
| push eax |
| push dword ptr fs:[00000000h] |
| lea eax, dword ptr [esp+0Ch] |
| sub esp, dword ptr [esp+0Ch] |
Rich Headers |
|---|
| Programming Language: |
|
Data Directories |
|---|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x48000 | 0x50 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x49000 | 0x59689 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xa3000 | 0x1db0 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x3b0a0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x3ea50 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x4826c | 0x21c | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Sections |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x382bb | 0x38400 | False | 0.395729166667 | data | 5.67953550398 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
| .rdata | 0x3a000 | 0x8082 | 0x8200 | False | 0.237379807692 | data | 3.46352247423 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x43000 | 0x4598 | 0x2000 | False | 0.2734375 | data | 3.48353069957 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .idata | 0x48000 | 0xc7b | 0xe00 | False | 0.318080357143 | data | 4.19163051635 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x49000 | 0x59689 | 0x59800 | False | 0.644514883031 | data | 6.09524824059 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xa3000 | 0x25c6 | 0x2600 | False | 0.625616776316 | data | 5.79339854832 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Resources |
|---|
| Name | RVA | Size | Type | Language | Country |
|---|---|---|---|---|---|
| RT_ICON | 0x906e0 | 0x2e8 | data | ||
| RT_ICON | 0x909c8 | 0x1e8 | data | ||
| RT_ICON | 0x90bb0 | 0x128 | GLS_BINARY_LSB_FIRST | ||
| RT_ICON | 0x90cd8 | 0x6c8 | data | ||
| RT_ICON | 0x913a0 | 0x568 | GLS_BINARY_LSB_FIRST | ||
| RT_ICON | 0x91908 | 0x988 | data | ||
| RT_ICON | 0x92290 | 0xca8 | data | ||
| RT_ICON | 0x92f38 | 0xf0 | data | ||
| RT_ICON | 0x93028 | 0xd0 | data | ||
| RT_ICON | 0x930f8 | 0xb0 | GLS_BINARY_LSB_FIRST | ||
| RT_ICON | 0x931a8 | 0x368 | GLS_BINARY_LSB_FIRST | ||
| RT_MESSAGETABLE | 0x49518 | 0x471c6 | data | ||
| RT_GROUP_ICON | 0x93510 | 0xa0 | data | ||
| RT_VERSION | 0x935b0 | 0x270 | data | English | United States |
| RT_MANIFEST | 0x49510 | 0x2 | Little-endian UTF-16 Unicode text, with no line terminators | English | United States |
Imports |
|---|
| DLL | Import |
|---|---|
| KERNEL32.dll | MultiByteToWideChar, lstrlenA, LoadResource, SizeofResource, VirtualAlloc, FindResourceA, SetStdHandle, WriteConsoleW, LoadLibraryW, FreeLibrary, SetConsoleCtrlHandler, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, EncodePointer, DecodePointer, Sleep, InterlockedExchange, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InterlockedCompareExchange, GetLastError, HeapAlloc, RtlUnwind, RaiseException, HeapFree, GetCommandLineA, HeapSetInformation, GetStartupInfoW, LCMapStringW, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, SetLastError, GetCurrentThreadId, GetCurrentThread, GetProcAddress, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, HeapDestroy, IsProcessorFeaturePresent, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, FatalAppExitA, GetConsoleCP, GetConsoleMode, FlushFileBuffers, ReadFile, SetFilePointer, CloseHandle, HeapSize, GetLocaleInfoW, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeW, HeapReAlloc, CreateFileW |
| USER32.dll | GetSystemMetrics, GetDC |
| SHELL32.dll | SHGetFolderPathA |
Version Infos |
|---|
| Description | Data |
|---|---|
| InternalName | correct.dll |
| FileVersion | 1.85.0.158 |
| CompanyName | ol3 corp. |
| ProductName | ol3 |
| ProductVersion | 1.8.80.158 |
| FileDescription | rne topd netikoe |
| OriginalFilename | correct.dll |
| Translation | 0x0409 0x04b0 |
Possible Origin |
|---|
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Snort IDS Alerts |
|---|
| Timestamp | Protocol | SID | Message | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 11/06/21-15:12:49.197619 | TCP | 2404332 | ET CNC Feodo Tracker Reported CnC Server TCP group 17 | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| 11/06/21-15:21:02.586000 | TCP | 2404302 | ET CNC Feodo Tracker Reported CnC Server TCP group 2 | 49809 | 443 | 192.168.11.20 | 103.75.32.173 |
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 6, 2021 15:12:49.197618961 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.197639942 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.197861910 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.199352980 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.199362993 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.483762026 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.483999014 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.486428976 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.486438036 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.486572027 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.532761097 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.536186934 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.579845905 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.720767021 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.720912933 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.721072912 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.721539974 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.721550941 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.721553087 CET | 49778 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.721556902 CET | 443 | 49778 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.800159931 CET | 49779 | 80 | 192.168.11.20 | 116.203.16.95 |
| Nov 6, 2021 15:12:49.812932968 CET | 80 | 49779 | 116.203.16.95 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.813069105 CET | 49779 | 80 | 192.168.11.20 | 116.203.16.95 |
| Nov 6, 2021 15:12:49.813164949 CET | 49779 | 80 | 192.168.11.20 | 116.203.16.95 |
| Nov 6, 2021 15:12:49.825892925 CET | 80 | 49779 | 116.203.16.95 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.826919079 CET | 80 | 49779 | 116.203.16.95 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.828425884 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.828438044 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.828799009 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.828814983 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:49.828819036 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:49.876342058 CET | 49779 | 80 | 192.168.11.20 | 116.203.16.95 |
| Nov 6, 2021 15:12:50.109899044 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.110649109 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.110657930 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.110831022 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.110836983 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.388792992 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.388807058 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.388829947 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.389008999 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.389267921 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.389276028 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.389276981 CET | 49780 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.389280081 CET | 443 | 49780 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.446024895 CET | 49781 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.446041107 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.446269035 CET | 49781 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.446367979 CET | 49781 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.446376085 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.693825006 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.694212914 CET | 49781 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.694221973 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.694539070 CET | 49781 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.694544077 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.997663975 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.997718096 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:50.997845888 CET | 49781 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.997931004 CET | 49781 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:50.997937918 CET | 443 | 49781 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.007548094 CET | 49782 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.007564068 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.007747889 CET | 49782 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.007780075 CET | 49782 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.007786036 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.271843910 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.272322893 CET | 49782 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.272335052 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.272664070 CET | 49782 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.272671938 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.539665937 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.539697886 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.539952993 CET | 49782 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.540036917 CET | 49782 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.540047884 CET | 443 | 49782 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.557549953 CET | 49783 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.557565928 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.557816029 CET | 49783 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.558015108 CET | 49783 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.558024883 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.816283941 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.816849947 CET | 49783 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.816860914 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:51.817229986 CET | 49783 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:51.817236900 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.152301073 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.152333975 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.152405024 CET | 49783 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:52.477027893 CET | 49783 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:52.477041006 CET | 443 | 49783 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.477535963 CET | 49784 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:52.477550983 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.477874041 CET | 49784 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:52.477884054 CET | 49784 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:52.477888107 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.737526894 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.737993956 CET | 49784 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:52.738003016 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.738265991 CET | 49784 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:52.738271952 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.919214010 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.919301033 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.919514894 CET | 49784 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.222915888 CET | 49784 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.223016977 CET | 443 | 49784 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.223356009 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.223501921 CET | 443 | 49785 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.223669052 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.223740101 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.223768950 CET | 443 | 49785 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.485657930 CET | 443 | 49785 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.486228943 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.486288071 CET | 443 | 49785 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.486501932 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.486534119 CET | 443 | 49785 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.701797962 CET | 443 | 49785 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.701963902 CET | 443 | 49785 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.702111006 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:12:54.702662945 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:54.702743053 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:54.702898979 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:54.703017950 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:54.703052998 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.133673906 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.134087086 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.135629892 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.135699987 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.136451006 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.137061119 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.179855108 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.243215084 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.243388891 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.243459940 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.243515968 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.243529081 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.243556976 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.243621111 CET | 49786 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.243665934 CET | 443 | 49786 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.244307041 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.244407892 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.244590044 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.244694948 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.244728088 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.462893009 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.463514090 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.463591099 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.463926077 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.463969946 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.715915918 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.716111898 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.716173887 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.716239929 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.716253042 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.716276884 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.716289997 CET | 49787 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.716306925 CET | 443 | 49787 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.716870070 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.716953039 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.717184067 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.717262983 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.717295885 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.938890934 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.939333916 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.939410925 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:56.939599037 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:56.939636946 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.180943012 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.181082964 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.181124926 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.181169987 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.181180954 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.181200027 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.181257963 CET | 49788 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.181277990 CET | 443 | 49788 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.181741953 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.181835890 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.182035923 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.182111025 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.182146072 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.451272011 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.451667070 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.451746941 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:12:57.451931000 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:12:57.451963902 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:00.353534937 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:00.405301094 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:00.405356884 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:00.452239037 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:00.457199097 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:00.457437992 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:00.457485914 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:00.499044895 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:01.501383066 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:01.501610041 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:01.501780987 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:01.501836061 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:01.502001047 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:01.502123117 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:01.502190113 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:01.502233982 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:01.502247095 CET | 49789 | 443 | 192.168.11.20 | 24.45.255.9 |
| Nov 6, 2021 15:13:01.502278090 CET | 443 | 49789 | 24.45.255.9 | 192.168.11.20 |
| Nov 6, 2021 15:13:01.645750999 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:01.645771980 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:01.645988941 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:01.646187067 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:01.646200895 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:02.872392893 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:02.872658014 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:02.873712063 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:02.873738050 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:02.874170065 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:02.874768972 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:02.915827990 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.675462008 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.675527096 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.675570965 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.675787926 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:03.675842047 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.675853014 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:03.675932884 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:03.676099062 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:03.686665058 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.686714888 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.686851025 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:03.687028885 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:03.687081099 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:03.732734919 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.078321934 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.078329086 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.078393936 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.078525066 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.078557968 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.078567982 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.078665972 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.078684092 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.078829050 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.079037905 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.093019962 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.093055010 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.093256950 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.093280077 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.093295097 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.093664885 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.104547977 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.104593039 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.104949951 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.105058908 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.105103970 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.105406046 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.476418018 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.476438999 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.476548910 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.476634979 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.476691008 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.476705074 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.476723909 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.476737976 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.476995945 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.486882925 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.486937046 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.487138033 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.487194061 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.487281084 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.487432957 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.499034882 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.499090910 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.499278069 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.499325037 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.499355078 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.499577999 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.510437012 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.510495901 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.510704994 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.510760069 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.510772943 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.510917902 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.522459030 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.522512913 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.522736073 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.522882938 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.522931099 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.522944927 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.523240089 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.877101898 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.877123117 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.877233028 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.877407074 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.877460957 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.877474070 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.877753019 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.888370991 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.888425112 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.888637066 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.888683081 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.888873100 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.888911963 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.901177883 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.901231050 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.901382923 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.901422024 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.901454926 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.901576996 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.901612043 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.911856890 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.911914110 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.912055016 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.912086964 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.912112951 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.912235975 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.912270069 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.925657988 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.925710917 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.925868988 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.925903082 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.925928116 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:04.926127911 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:04.926189899 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.274667978 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.274689913 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.274822950 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.274966955 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.275024891 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.275180101 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.275214911 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.287187099 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.287245035 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.287441969 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.287489891 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.287614107 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.287661076 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.299772024 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.299864054 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.299977064 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.300013065 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.300023079 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.300046921 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.300169945 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.300225973 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.311120033 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.311163902 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.311327934 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.311465979 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.311515093 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.311815023 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.322243929 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.322254896 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.322422028 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.322431087 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.322437048 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.322525978 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.322799921 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.365916014 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.365923882 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.366208076 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.366218090 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.366419077 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.681142092 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.681147099 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.681256056 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.681308985 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.681317091 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.681318998 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.681405067 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.681407928 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.681495905 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.681544065 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.694380045 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.694392920 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.694520950 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.694591045 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.694596052 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.694705963 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.694843054 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.705820084 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.705831051 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.706085920 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.706094027 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.706202030 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.716557980 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.716567993 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.716752052 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.716911077 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.716919899 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.717140913 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.734922886 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.734932899 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.735111952 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.735163927 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:05.735169888 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:05.735496998 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.071389914 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.071420908 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.071532965 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.071710110 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.071777105 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.071795940 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.071924925 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.071969986 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.085104942 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.085174084 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.085378885 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.085457087 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.085474968 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.085787058 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.097645044 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.097728968 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.097898960 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.097949028 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.097985983 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.098243952 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.109036922 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.109103918 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.109288931 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.109332085 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.109363079 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.109628916 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.130475998 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.130532980 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.130671978 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.130708933 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.130734921 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.130939007 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.130995989 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.143130064 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.143182993 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.143338919 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.143373013 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.143399000 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.143515110 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.143572092 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.472296000 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.472316980 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.472486019 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.472532988 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.472584963 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.472598076 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.472615957 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.472630978 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.472758055 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.472809076 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.486824036 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.486876965 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.487013102 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.487129927 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.487150908 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.487302065 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.499453068 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.499510050 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.499645948 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.499680042 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.499705076 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.499867916 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.499922037 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.511491060 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.511565924 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.511733055 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.511967897 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.512016058 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.512299061 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.527400970 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.527465105 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.527587891 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.527626991 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.527656078 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.527779102 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.527930975 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.542012930 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.542074919 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.542229891 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.542265892 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.542294025 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.542407990 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.542558908 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.869923115 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.869945049 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.870088100 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.870218992 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.870271921 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.870285988 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.870435953 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.870488882 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.883718967 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.883773088 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.883918047 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.884118080 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.884166002 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.884450912 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.897034883 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.897088051 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.897295952 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.897330046 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.897440910 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.897485971 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.897496939 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.897711992 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.911504030 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.911541939 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.911778927 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.911819935 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.911865950 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.911993027 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.923324108 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.923335075 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.923518896 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.923526049 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.923531055 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.923619032 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.923688889 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.937355042 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.937365055 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.937586069 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.937594891 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.937695026 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.937803030 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.963382006 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.963393927 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.963572979 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.963644028 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.963654995 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:06.963707924 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:06.963901997 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.274981022 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.275001049 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.275127888 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.275278091 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.275331020 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.275367022 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.275737047 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.289522886 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.289588928 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.289691925 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.289752007 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.289779902 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.289983034 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.290041924 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.302083015 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.302143097 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.302470922 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.302524090 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.302814007 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.305778027 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.305954933 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.306066036 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.306109905 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.306165934 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.306180954 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.306210995 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:07.306216955 CET | 49800 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:13:07.306241989 CET | 443 | 49800 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:13:54.824568987 CET | 80 | 49779 | 116.203.16.95 | 192.168.11.20 |
| Nov 6, 2021 15:13:54.824753046 CET | 49779 | 80 | 192.168.11.20 | 116.203.16.95 |
| Nov 6, 2021 15:13:54.824764967 CET | 49779 | 80 | 192.168.11.20 | 116.203.16.95 |
| Nov 6, 2021 15:13:54.837656021 CET | 80 | 49779 | 116.203.16.95 | 192.168.11.20 |
| Nov 6, 2021 15:14:11.281979084 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:11.581499100 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:11.581521034 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:11.581713915 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:11.581737995 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:11.581744909 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:11.592830896 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:11.846121073 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:11.846549034 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:11.846622944 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:11.847130060 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:11.847179890 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.029892921 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.030081034 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.030249119 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.030304909 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.030348063 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.030359030 CET | 49803 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.030385971 CET | 443 | 49803 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.202085972 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.291553974 CET | 49804 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.291626930 CET | 443 | 49804 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.291758060 CET | 49804 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.291862011 CET | 49804 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.291892052 CET | 443 | 49804 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.559123039 CET | 443 | 49804 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.559557915 CET | 49804 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.559622049 CET | 443 | 49804 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.560061932 CET | 49804 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.560103893 CET | 443 | 49804 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.838079929 CET | 443 | 49804 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.838274002 CET | 443 | 49804 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.838579893 CET | 49804 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:12.838934898 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:12.839025021 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:12.839211941 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:12.839282036 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:12.839313984 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.358984947 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:13.359081030 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.359227896 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:13.359308958 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:13.359344006 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.404983044 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:13.610596895 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.610959053 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:13.611011028 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.611574888 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:13.611604929 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.611618996 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:13.611635923 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.923357964 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.923635006 CET | 443 | 49806 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:13.923858881 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:14.045749903 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.046138048 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.046222925 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.046514034 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.046552896 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.847728968 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.847793102 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.847888947 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.847920895 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.847956896 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.848062038 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.848165989 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.858530045 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.858588934 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.858748913 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.858786106 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.858809948 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:14.858954906 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:14.904675007 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.251378059 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.251409054 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.251533031 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.251606941 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.251672983 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.251692057 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.251702070 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.251836061 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.251893044 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.251907110 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.252087116 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.262761116 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.262830973 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.263012886 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.263055086 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.263087034 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.263282061 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.275080919 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.275155067 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.275255919 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.275317907 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.275347948 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.275475979 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.275700092 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.577392101 CET | 49807 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:15.577491999 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.577688932 CET | 49807 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:15.577764034 CET | 49807 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:15.577791929 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.650239944 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.650260925 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.650369883 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.650470018 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.650536060 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.650691032 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.650861025 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.661427975 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.661480904 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.661634922 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.661782980 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.661834955 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.662103891 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.672877073 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.672924042 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.673115969 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.673170090 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.673203945 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.673496008 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.684238911 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.684284925 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.684417963 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.684462070 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.684497118 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.684613943 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.684806108 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.696270943 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.696317911 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.696552038 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.696599960 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.696716070 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.696763039 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:15.810692072 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:15.839534044 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.840013027 CET | 49807 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:15.840080023 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.840257883 CET | 49807 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:15.840287924 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:15.840295076 CET | 49807 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:15.840308905 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.047058105 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.047070980 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.047215939 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.047243118 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.047274113 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.047306061 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.047327042 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.047544956 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.059628010 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.059649944 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.059854031 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.059870958 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.060040951 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.060206890 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.074456930 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.074507952 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.074640989 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.074678898 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.074790001 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.074840069 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.075113058 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.085798025 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.085853100 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.086152077 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.086203098 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.086472034 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.098516941 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.098568916 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.098742008 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.098776102 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.098807096 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.099066973 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.109915018 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.109989882 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.110291004 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.110346079 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.110677958 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.158102036 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.158262968 CET | 443 | 49807 | 46.99.175.217 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.158482075 CET | 49807 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:16.454385996 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.454405069 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.454492092 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.454642057 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.454699993 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.454716921 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.454862118 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.455018997 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.470720053 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.470772982 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.470988989 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.471021891 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.471049070 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.471375942 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.482691050 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.482752085 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.482954025 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.482994080 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.483004093 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.483321905 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.496634960 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.496685982 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.496814013 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.496907949 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.496941090 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.497230053 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.509263039 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.509315968 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.509463072 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.509491920 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.509510994 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.509605885 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.509838104 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.843725920 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.843753099 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.843883038 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.844080925 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.844136000 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.844146967 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.844388008 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.860668898 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.860726118 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.860892057 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.860925913 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.860935926 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.860958099 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.860980988 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.861144066 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.874784946 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.874847889 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.875097990 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.875152111 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.875166893 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.875418901 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.885981083 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.886043072 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.886214018 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.886390924 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.886442900 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.886718988 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.899971008 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.900027990 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.900214911 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.900254011 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.900280952 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.900293112 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.900515079 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.911251068 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.911305904 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.911462069 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.911501884 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.911529064 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:16.911732912 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:16.911773920 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.243643045 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.243664026 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.243792057 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.243844032 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.243905067 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.243916035 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.243935108 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.244054079 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.244087934 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.261534929 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.261615992 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.261748075 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.261785030 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.261820078 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.261832952 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.261960030 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.262036085 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.276742935 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.276814938 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.276922941 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.276957989 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.276968002 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.276992083 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.277209044 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.289347887 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.289416075 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.289572001 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.289613008 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.289640903 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.289668083 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.289859056 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.301208019 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.301276922 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.301592112 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.301644087 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.301914930 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.306735992 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.306927919 CET | 443 | 49805 | 202.58.199.82 | 192.168.11.20 |
| Nov 6, 2021 15:14:17.306934118 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.306977034 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:17.307151079 CET | 49805 | 443 | 192.168.11.20 | 202.58.199.82 |
| Nov 6, 2021 15:14:20.622040987 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:14:30.229357958 CET | 49785 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:21:02.098331928 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:21:02.409603119 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:21:03.018296957 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
| Nov 6, 2021 15:21:04.221173048 CET | 49806 | 443 | 192.168.11.20 | 46.99.175.217 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 6, 2021 15:12:49.787261963 CET | 60642 | 53 | 192.168.11.20 | 1.1.1.1 |
| Nov 6, 2021 15:12:49.796946049 CET | 53 | 60642 | 1.1.1.1 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.152865887 CET | 52053 | 53 | 192.168.11.20 | 1.1.1.1 |
| Nov 6, 2021 15:12:52.246351004 CET | 53 | 52053 | 1.1.1.1 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.247102976 CET | 60026 | 53 | 192.168.11.20 | 1.1.1.1 |
| Nov 6, 2021 15:12:52.266434908 CET | 53 | 60026 | 1.1.1.1 | 192.168.11.20 |
| Nov 6, 2021 15:12:52.267092943 CET | 64219 | 53 | 192.168.11.20 | 1.1.1.1 |
| Nov 6, 2021 15:12:52.476409912 CET | 53 | 64219 | 1.1.1.1 | 192.168.11.20 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Nov 6, 2021 15:12:49.787261963 CET | 192.168.11.20 | 1.1.1.1 | 0x6d6a | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 6, 2021 15:12:52.152865887 CET | 192.168.11.20 | 1.1.1.1 | 0xca85 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 6, 2021 15:12:52.247102976 CET | 192.168.11.20 | 1.1.1.1 | 0x5df7 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 6, 2021 15:12:52.267092943 CET | 192.168.11.20 | 1.1.1.1 | 0xb01e | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Nov 6, 2021 15:12:49.796946049 CET | 1.1.1.1 | 192.168.11.20 | 0x6d6a | No error (0) | 116.203.16.95 | A (IP address) | IN (0x0001) | ||
| Nov 6, 2021 15:12:52.246351004 CET | 1.1.1.1 | 192.168.11.20 | 0xca85 | Name error (3) | none | none | A (IP address) | IN (0x0001) | |
| Nov 6, 2021 15:12:52.266434908 CET | 1.1.1.1 | 192.168.11.20 | 0x5df7 | Name error (3) | none | none | A (IP address) | IN (0x0001) | |
| Nov 6, 2021 15:12:52.476409912 CET | 1.1.1.1 | 192.168.11.20 | 0xb01e | No error (0) | 127.0.0.2 | A (IP address) | IN (0x0001) |
HTTP Request Dependency Graph |
|---|
|
HTTP Packets |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.11.20 | 49778 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 1 | 192.168.11.20 | 49780 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 10 | 192.168.11.20 | 49789 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 11 | 192.168.11.20 | 49800 | 202.58.199.82 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 12 | 192.168.11.20 | 49803 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 13 | 192.168.11.20 | 49804 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 14 | 192.168.11.20 | 49806 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 15 | 192.168.11.20 | 49805 | 202.58.199.82 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 16 | 192.168.11.20 | 49807 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 17 | 192.168.11.20 | 49779 | 116.203.16.95 | 80 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Nov 6, 2021 15:12:49.813164949 CET | 16 | OUT | |
| Nov 6, 2021 15:12:49.826919079 CET | 16 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 2 | 192.168.11.20 | 49781 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 3 | 192.168.11.20 | 49782 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 4 | 192.168.11.20 | 49783 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 5 | 192.168.11.20 | 49784 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 6 | 192.168.11.20 | 49785 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 7 | 192.168.11.20 | 49786 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 8 | 192.168.11.20 | 49787 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 9 | 192.168.11.20 | 49788 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|
HTTPS Proxied Packets |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.11.20 | 49778 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:49 UTC | 0 | OUT | |
| 2021-11-06 14:12:49 UTC | 0 | IN | |
| 2021-11-06 14:12:49 UTC | 0 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 1 | 192.168.11.20 | 49780 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:50 UTC | 0 | OUT | |
| 2021-11-06 14:12:50 UTC | 0 | IN | |
| 2021-11-06 14:12:50 UTC | 0 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 10 | 192.168.11.20 | 49789 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:57 UTC | 5 | OUT | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 5 | IN | |
| 2021-11-06 14:13:00 UTC | 7 | IN | |
| 2021-11-06 14:13:01 UTC | 7 | IN | |
| 2021-11-06 14:13:01 UTC | 7 | IN | |
| 2021-11-06 14:13:01 UTC | 9 | IN | |
| 2021-11-06 14:13:01 UTC | 9 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 11 | 192.168.11.20 | 49800 | 202.58.199.82 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:13:02 UTC | 9 | OUT | |
| 2021-11-06 14:13:03 UTC | 9 | IN | |
| 2021-11-06 14:13:03 UTC | 9 | IN | |
| 2021-11-06 14:13:03 UTC | 25 | IN | |
| 2021-11-06 14:13:04 UTC | 41 | IN | |
| 2021-11-06 14:13:04 UTC | 57 | IN | |
| 2021-11-06 14:13:04 UTC | 73 | IN | |
| 2021-11-06 14:13:04 UTC | 89 | IN | |
| 2021-11-06 14:13:04 UTC | 105 | IN | |
| 2021-11-06 14:13:04 UTC | 121 | IN | |
| 2021-11-06 14:13:04 UTC | 137 | IN | |
| 2021-11-06 14:13:04 UTC | 153 | IN | |
| 2021-11-06 14:13:04 UTC | 169 | IN | |
| 2021-11-06 14:13:04 UTC | 185 | IN | |
| 2021-11-06 14:13:04 UTC | 201 | IN | |
| 2021-11-06 14:13:04 UTC | 217 | IN | |
| 2021-11-06 14:13:04 UTC | 233 | IN | |
| 2021-11-06 14:13:05 UTC | 249 | IN | |
| 2021-11-06 14:13:05 UTC | 265 | IN | |
| 2021-11-06 14:13:05 UTC | 281 | IN | |
| 2021-11-06 14:13:05 UTC | 297 | IN | |
| 2021-11-06 14:13:05 UTC | 313 | IN | |
| 2021-11-06 14:13:05 UTC | 329 | IN | |
| 2021-11-06 14:13:05 UTC | 345 | IN | |
| 2021-11-06 14:13:05 UTC | 361 | IN | |
| 2021-11-06 14:13:05 UTC | 377 | IN | |
| 2021-11-06 14:13:05 UTC | 393 | IN | |
| 2021-11-06 14:13:05 UTC | 409 | IN | |
| 2021-11-06 14:13:06 UTC | 425 | IN | |
| 2021-11-06 14:13:06 UTC | 441 | IN | |
| 2021-11-06 14:13:06 UTC | 457 | IN | |
| 2021-11-06 14:13:06 UTC | 473 | IN | |
| 2021-11-06 14:13:06 UTC | 489 | IN | |
| 2021-11-06 14:13:06 UTC | 505 | IN | |
| 2021-11-06 14:13:06 UTC | 521 | IN | |
| 2021-11-06 14:13:06 UTC | 537 | IN | |
| 2021-11-06 14:13:06 UTC | 553 | IN | |
| 2021-11-06 14:13:06 UTC | 569 | IN | |
| 2021-11-06 14:13:06 UTC | 585 | IN | |
| 2021-11-06 14:13:06 UTC | 601 | IN | |
| 2021-11-06 14:13:06 UTC | 617 | IN | |
| 2021-11-06 14:13:06 UTC | 633 | IN | |
| 2021-11-06 14:13:06 UTC | 649 | IN | |
| 2021-11-06 14:13:06 UTC | 665 | IN | |
| 2021-11-06 14:13:06 UTC | 681 | IN | |
| 2021-11-06 14:13:06 UTC | 697 | IN | |
| 2021-11-06 14:13:06 UTC | 713 | IN | |
| 2021-11-06 14:13:07 UTC | 729 | IN | |
| 2021-11-06 14:13:07 UTC | 745 | IN | |
| 2021-11-06 14:13:07 UTC | 761 | IN | |
| 2021-11-06 14:13:07 UTC | 777 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 12 | 192.168.11.20 | 49803 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:14:11 UTC | 782 | OUT | |
| 2021-11-06 14:14:12 UTC | 782 | IN | |
| 2021-11-06 14:14:12 UTC | 782 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 13 | 192.168.11.20 | 49804 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:14:12 UTC | 783 | OUT | |
| 2021-11-06 14:14:12 UTC | 783 | IN | |
| 2021-11-06 14:14:12 UTC | 784 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 14 | 192.168.11.20 | 49806 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:14:13 UTC | 784 | OUT | |
| 2021-11-06 14:14:13 UTC | 784 | OUT | |
| 2021-11-06 14:14:13 UTC | 784 | IN | |
| 2021-11-06 14:14:13 UTC | 784 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 15 | 192.168.11.20 | 49805 | 202.58.199.82 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:14:14 UTC | 784 | OUT | |
| 2021-11-06 14:14:14 UTC | 784 | IN | |
| 2021-11-06 14:14:14 UTC | 785 | IN | |
| 2021-11-06 14:14:14 UTC | 800 | IN | |
| 2021-11-06 14:14:15 UTC | 816 | IN | |
| 2021-11-06 14:14:15 UTC | 832 | IN | |
| 2021-11-06 14:14:15 UTC | 848 | IN | |
| 2021-11-06 14:14:15 UTC | 864 | IN | |
| 2021-11-06 14:14:15 UTC | 880 | IN | |
| 2021-11-06 14:14:15 UTC | 896 | IN | |
| 2021-11-06 14:14:15 UTC | 912 | IN | |
| 2021-11-06 14:14:15 UTC | 928 | IN | |
| 2021-11-06 14:14:16 UTC | 945 | IN | |
| 2021-11-06 14:14:16 UTC | 961 | IN | |
| 2021-11-06 14:14:16 UTC | 977 | IN | |
| 2021-11-06 14:14:16 UTC | 993 | IN | |
| 2021-11-06 14:14:16 UTC | 1009 | IN | |
| 2021-11-06 14:14:16 UTC | 1025 | IN | |
| 2021-11-06 14:14:16 UTC | 1041 | IN | |
| 2021-11-06 14:14:16 UTC | 1057 | IN | |
| 2021-11-06 14:14:16 UTC | 1073 | IN | |
| 2021-11-06 14:14:16 UTC | 1089 | IN | |
| 2021-11-06 14:14:16 UTC | 1105 | IN | |
| 2021-11-06 14:14:16 UTC | 1121 | IN | |
| 2021-11-06 14:14:16 UTC | 1137 | IN | |
| 2021-11-06 14:14:16 UTC | 1153 | IN | |
| 2021-11-06 14:14:16 UTC | 1169 | IN | |
| 2021-11-06 14:14:16 UTC | 1185 | IN | |
| 2021-11-06 14:14:16 UTC | 1201 | IN | |
| 2021-11-06 14:14:17 UTC | 1217 | IN | |
| 2021-11-06 14:14:17 UTC | 1233 | IN | |
| 2021-11-06 14:14:17 UTC | 1249 | IN | |
| 2021-11-06 14:14:17 UTC | 1265 | IN | |
| 2021-11-06 14:14:17 UTC | 1281 | IN | |
| 2021-11-06 14:14:17 UTC | 1297 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 16 | 192.168.11.20 | 49807 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:14:15 UTC | 944 | OUT | |
| 2021-11-06 14:14:15 UTC | 944 | OUT | |
| 2021-11-06 14:14:16 UTC | 1041 | IN | |
| 2021-11-06 14:14:16 UTC | 1041 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 2 | 192.168.11.20 | 49781 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:50 UTC | 2 | OUT | |
| 2021-11-06 14:12:50 UTC | 2 | IN | |
| 2021-11-06 14:12:50 UTC | 2 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 3 | 192.168.11.20 | 49782 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:51 UTC | 2 | OUT | |
| 2021-11-06 14:12:51 UTC | 2 | IN | |
| 2021-11-06 14:12:51 UTC | 2 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 4 | 192.168.11.20 | 49783 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:51 UTC | 2 | OUT | |
| 2021-11-06 14:12:52 UTC | 3 | IN | |
| 2021-11-06 14:12:52 UTC | 3 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 5 | 192.168.11.20 | 49784 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:52 UTC | 3 | OUT | |
| 2021-11-06 14:12:52 UTC | 3 | IN | |
| 2021-11-06 14:12:52 UTC | 3 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 6 | 192.168.11.20 | 49785 | 46.99.175.217 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:54 UTC | 3 | OUT | |
| 2021-11-06 14:12:54 UTC | 3 | IN | |
| 2021-11-06 14:12:54 UTC | 3 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 7 | 192.168.11.20 | 49786 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:56 UTC | 3 | OUT | |
| 2021-11-06 14:12:56 UTC | 4 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 8 | 192.168.11.20 | 49787 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:56 UTC | 4 | OUT | |
| 2021-11-06 14:12:56 UTC | 4 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 9 | 192.168.11.20 | 49788 | 24.45.255.9 | 443 | C:\Windows\System32\wermgr.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-06 14:12:56 UTC | 4 | OUT | |
| 2021-11-06 14:12:57 UTC | 4 | IN |
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 15:12:35 |
| Start date: | 06/11/2021 |
| Path: | C:\Users\user\Desktop\dngqoAXyDd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x730000 |
| File size: | 652800 bytes |
| MD5 hash: | 0AFBB383C5CEA9F11202D572141BB0F4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
General |
|---|
| Start time: | 15:12:37 |
| Start date: | 06/11/2021 |
| Path: | C:\Windows\System32\wermgr.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff756870000 |
| File size: | 228680 bytes |
| MD5 hash: | F7991343CF02ED92CB59F394E8B89F1F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 15:12:38 |
| Start date: | 06/11/2021 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff743ff0000 |
| File size: | 289792 bytes |
| MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 15:12:54 |
| Start date: | 06/11/2021 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff743ff0000 |
| File size: | 289792 bytes |
| MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 15:12:54 |
| Start date: | 06/11/2021 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff60ab30000 |
| File size: | 875008 bytes |
| MD5 hash: | 81CA40085FC75BABD2C91D18AA9FFA68 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 15:13:07 |
| Start date: | 06/11/2021 |
| Path: | C:\Windows\System32\svchost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff67bdd0000 |
| File size: | 57360 bytes |
| MD5 hash: | F586835082F632DC8D9404D83BC16316 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
Disassembly |
|---|
Code Analysis |
|---|
Executed Functions |
|---|
Function 02883168, Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1008sleepCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00731E80, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 132memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00746CA7, Relevance: 7.6, APIs: 5, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0073CE81, Relevance: 4.6, APIs: 3, Instructions: 98memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00731900, Relevance: 2.5, APIs: 2, Instructions: 46COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0073B772, Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074D266, Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 007430C4, Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0073FF87, Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0073FF42, Relevance: 1.3, APIs: 1, Instructions: 28sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Non-executed Functions |
|---|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074DD3C, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 83libraryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00759E7F, Relevance: 9.5, Strings: 7, Instructions: 761COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0073CFF8, Relevance: 7.6, APIs: 5, Instructions: 58COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 007486AD, Relevance: 6.2, APIs: 4, Instructions: 155COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00749F63, Relevance: 4.7, APIs: 3, Instructions: 179COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00757650, Relevance: 4.6, APIs: 3, Instructions: 91COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074293C, Relevance: 4.6, APIs: 3, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0075911C, Relevance: 2.8, Strings: 2, Instructions: 253COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0075941B, Relevance: 1.8, Strings: 1, Instructions: 592COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00757D6E, Relevance: 1.8, Strings: 1, Instructions: 523COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0075880E, Relevance: 1.8, Strings: 1, Instructions: 517COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00745C19, Relevance: 1.8, APIs: 1, Instructions: 266COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074B9CE, Relevance: 1.7, Strings: 1, Instructions: 489COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074A134, Relevance: 1.6, APIs: 1, Instructions: 78COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00749E61, Relevance: 1.6, APIs: 1, Instructions: 58COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00749F08, Relevance: 1.5, APIs: 1, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074A220, Relevance: 1.5, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074A287, Relevance: 1.5, APIs: 1, Instructions: 22COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074A1F6, Relevance: 1.5, APIs: 1, Instructions: 14COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074676A, Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0073C950, Relevance: 1.3, Strings: 1, Instructions: 76COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 007582BD, Relevance: .5, Instructions: 517COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074C9BB, Relevance: .4, Instructions: 355COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074C5D3, Relevance: .3, Instructions: 349COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074C201, Relevance: .3, Instructions: 332COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074BE63, Relevance: .3, Instructions: 326COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00758EA1, Relevance: .2, Instructions: 214COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0075BBF1, Relevance: .2, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00741742, Relevance: .1, Instructions: 83COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00757918, Relevance: .1, Instructions: 81COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0074DF7C, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 134libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 007427B2, Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 109libraryloadermemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00747719, Relevance: 18.5, APIs: 12, Instructions: 494COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00742EDC, Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 148fileCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00742158, Relevance: 12.1, APIs: 8, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 007420C9, Relevance: 12.1, APIs: 8, Instructions: 58COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00746D3E, Relevance: 10.7, APIs: 7, Instructions: 196COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0073F210, Relevance: 9.2, APIs: 6, Instructions: 190COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00742576, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00742D0E, Relevance: 7.6, APIs: 5, Instructions: 98COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00742B4E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00731C90, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 83stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Executed Functions |
|---|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECC1EA0, Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1460COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECB14D0, Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 762COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECD52C0, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 501threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECCA280, Relevance: 1.6, APIs: 1, Instructions: 77libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECD39E0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECB8B90, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 207COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECC08C0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99processCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECB6050, Relevance: 3.1, APIs: 2, Instructions: 111networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECB1DF0, Relevance: 1.6, APIs: 1, Instructions: 150synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECCCD60, Relevance: 1.5, APIs: 1, Instructions: 24injectionCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Non-executed Functions |
|---|
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECC0A00, Relevance: .7, Instructions: 711COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECCE3F0, Relevance: .4, Instructions: 389COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECBE320, Relevance: .3, Instructions: 334COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECCFBA0, Relevance: .3, Instructions: 294COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECC4D50, Relevance: .2, Instructions: 155COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECB2BC0, Relevance: .1, Instructions: 111COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECCB520, Relevance: .1, Instructions: 98COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECB6EF0, Relevance: .1, Instructions: 85COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECD5EC0, Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECC4060, Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECB5BE0, Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECC9460, Relevance: .1, Instructions: 67COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECD3990, Relevance: .0, Instructions: 22COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 000001767ECCADA0, Relevance: .0, Instructions: 6COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |