Edit tour
Windows
Analysis Report
IMS64.dll.dll
Overview
General Information
| Sample name: | IMS64.dll.dll (renamed file extension from exe to dll) |
| Original sample name: | IMS64.dll.exe |
| Analysis ID: | 1500442 |
| MD5: | 4a10fb513a346ffdca884fa74cf18015 |
| SHA1: | 623b8046938fd54fae54957ece8c7ff40653217b |
| SHA256: | 079e3171048286472cff2b0267cd2d6a90bf9d7f45255f48031bf4bf2ac3b0b4 |
| Tags: | exejavaforyouedu-in |
| Infos: |  |
 | |
Detection
BruteRatel
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected BruteRatel
AI detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Sets debug register (to hijack the execution of another thread)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query network adapater information
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
loaddll64.exe (PID: 7308 cmdline: loaddll64. exe "C:\Us ers\user\D esktop\IMS 64.dll.dll " MD5: 763455F9DCB24DFEECC2B9D9F8D46D52) 
conhost.exe (PID: 7316 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7360 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\IMS 64.dll.dll ",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) 
rundll32.exe (PID: 7396 cmdline: rundll32.e xe "C:\Use rs\user\De sktop\IMS6 4.dll.dll" ,#1 MD5: EF3179D498793BF4234F708D3BE28633) - rundll32.exe (PID: 7372 cmdline:
rundll32.e xe C:\User s\user\Des ktop\IMS64 .dll.dll,m ain MD5: EF3179D498793BF4234F708D3BE28633) - rundll32.exe (PID: 7500 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\IMS6 4.dll.dll" ,main MD5: EF3179D498793BF4234F708D3BE28633)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Brute Ratel C4, BruteRatel | Brute Ratel is a a Customized Command and Control Center for Red Team and Adversary SimulationSMB and TCP payloads provide functionality to write custom external C2 channels over legitimate websites such as Slack, Discord, Microsoft Teams and more.Built-in debugger to detect EDR userland hooks.Ability to keep memory artifacts hidden from EDRs and AV.Direct Windows SYS calls on the fly. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_BruteRatel_2 | Yara detected BruteRatel | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
Networking | |
|---|
| Source: | Network Connect: | Jump to behavior | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 3_2_00007FFE133025E0 | |
| Source: | Code function: | 3_3_000001CDED27BA3A | |
| Source: | Code function: | 3_2_00007FFE133025E0 | |
| Source: | Code function: | 5_2_000001E8C8766150 | |
| Source: | Code function: | 5_2_000001E8C8764120 | |
| Source: | Code function: | 5_2_000001E8C8761D00 | |
| Source: | Code function: | 5_2_000001E8C87644F0 | |
| Source: | Code function: | 5_2_000001E8C874C9C0 | |
| Source: | Code function: | 5_2_000001E8C876E1B0 | |
| Source: | Code function: | 5_2_000001E8C87701B0 | |
| Source: | Code function: | 5_2_000001E8C8759580 | |
| Source: | Code function: | 5_2_000001E8C8745EC0 | |
| Source: | Code function: | 5_2_000001E8C875A2A0 | |
| Source: | Code function: | 5_2_000001E8C876F690 | |
| Source: | Code function: | 5_2_000001E8C8752B60 | |
| Source: | Code function: | 5_2_000001E8C8757750 | |
| Source: | Code function: | 5_2_000001E8C8756730 | |
| Source: | Code function: | 5_2_000001E8C87533A0 | |
| Source: | Code function: | 5_2_000001E8C875EBA0 | |
| Source: | Code function: | 5_2_000001E8C8758B90 | |
| Source: | Code function: | 5_2_000001E8C8760380 | |
| Source: | Code function: | 5_2_000001E8C874AF70 | |
| Source: | Code function: | 5_2_000001E8C874A020 | |
| Source: | Code function: | 5_2_000001E8C8752010 | |
| Source: | Code function: | 5_2_000001E8C8763010 | |
| Source: | Code function: | 5_2_000001E8C87650E0 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 5_2_000001E8C875CAD0 | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 4_2_000001FB0D91C2F1 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Code function: | 5_2_000001E8C87624C0 | |
| Source: | API coverage: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 5_2_000001E8C874D5C0 | |
| Source: | Code function: | 5_2_000001E8C874A8B0 | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 5_2_000001E8C87624C0 | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 311 Process Injection | 11 Virtualization/Sandbox Evasion | OS Credential Dumping | 1 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 311 Process Injection | LSASS Memory | 11 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 2 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Obfuscated Files or Information | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 13 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Rundll32 | NTDS | 1 Account Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 1 System Owner/User Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 1 System Network Configuration Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 1 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 29% | ReversingLabs | Win64.Backdoor.Brutel | ||
| 27% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| javaforyouedu.in | 43.206.237.192 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 43.206.237.192 | javaforyouedu.in | Japan | 4249 | LILLY-ASUS | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1500442 |
| Start date and time: | 2024-08-28 13:37:04 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 36s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | IMS64.dll.dll (renamed file extension from exe to dll) |
| Original Sample Name: | IMS64.dll.exe |
| Detection: | MAL |
| Classification: | mal76.troj.evad.winDLL@10/0@1/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target rundll32.exe, PID 7396 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 07:37:57 | API Interceptor |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| LILLY-ASUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | FormBook, GuLoader | Browse |
| |
| Get hash | malicious | AveMaria, UACMe, XRed | Browse |
| ||
| Get hash | malicious | Meduza Stealer | Browse |
| ||
| Get hash | malicious | LummaC, Vidar | Browse |
| ||
| Get hash | malicious | LummaC, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC, Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | LummaC, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC, Vidar | Browse |
|
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 7.954168963281946 |
| TrID: |
|
| File name: | IMS64.dll.dll |
| File size: | 270'336 bytes |
| MD5: | 4a10fb513a346ffdca884fa74cf18015 |
| SHA1: | 623b8046938fd54fae54957ece8c7ff40653217b |
| SHA256: | 079e3171048286472cff2b0267cd2d6a90bf9d7f45255f48031bf4bf2ac3b0b4 |
| SHA512: | 00931f752966cdcab894ca86301d12ac3ce06781e0fe9220054eb475770fda0aa8f58f863fab5225d2b8566fd7afe4aed69a56d2e791b590c0445305c479802f |
| SSDEEP: | 6144:M7tLKV/ZQEhoEo9/+CvLMtvs137aaaDnka/za1C/:M7t8WE+/xvcvs1EDkaz |
| TLSH: | 4E4412097AAAE4BCCE57D4F9056DE531643F31069C1C86B81E82E0373E677D835BA98C |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...!..f..........."...)............@.....................................................`... ............................ |
 | |
| Icon Hash: | 7ae282899bbab082 |
| Entrypoint: | 0x205d51340 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x205d50000 |
| Subsystem: | windows cui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED, DLL |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT |
| Time Stamp: | 0x66CD9421 [Tue Aug 27 08:53:53 2024 UTC] |
| TLS Callbacks: | 0x5d514f0, 0x2, 0x5d514c0, 0x2 |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | df00652ad3e78ba777ba702462655cf8 |
| Instruction |
|---|
| dec eax |
| mov eax, dword ptr [00040F09h] |
| mov dword ptr [eax], 00000000h |
| jmp 00007F0C98E08BE3h |
| nop word ptr [eax+eax+00000000h] |
| nop dword ptr [eax] |
| dec eax |
| mov edx, ecx |
| dec eax |
| lea ecx, dword ptr [00043C96h] |
| jmp 00007F0C98E09C06h |
| nop |
| dec eax |
| lea ecx, dword ptr [00000009h] |
| jmp 00007F0C98E08D39h |
| nop dword ptr [eax+00h] |
| ret |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| jmp 00007F0C98E08D6Eh |
| jmp 00007F0C98E08D60h |
| jmp 00007F0C98E08D54h |
| jmp 00007F0C98E08D74h |
| dec ecx |
| mov edx, ecx |
| dec esp |
| mov eax, ecx |
| jmp dword ptr [esp+28h] |
| dec ecx |
| mov edx, ecx |
| dec eax |
| mov eax, dword ptr [esp+30h] |
| jmp dword ptr [esp+38h] |
| dec ecx |
| mov edx, ecx |
| dec eax |
| mov eax, dword ptr [esp+38h] |
| jmp dword ptr [esp+40h] |
| dec ecx |
| mov edx, ecx |
| dec eax |
| mov eax, dword ptr [esp+60h] |
| jmp dword ptr [esp+68h] |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| push ebp |
| dec eax |
| mov ebp, esp |
| dec eax |
| sub esp, 20h |
| dec eax |
| mov eax, dword ptr [00001C21h] |
| dec eax |
| mov eax, dword ptr [eax] |
| dec eax |
| test eax, eax |
| je 00007F0C98E08D78h |
| nop word ptr [eax+eax+00000000h] |
| call eax |
| dec eax |
| mov eax, dword ptr [00001C07h] |
| dec eax |
| lea edx, dword ptr [eax+08h] |
| dec eax |
| mov eax, dword ptr [eax+08h] |
| dec eax |
| mov dword ptr [00001BF8h], edx |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x46000 | 0x44 | .edata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x47000 | 0x368 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x43000 | 0x21c | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x4a000 | 0x5c | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x42020 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x47100 | 0xc0 | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1888 | 0x1a00 | 079ade57fd7fd5e198c51331a35526be | False | 0.5805288461538461 | data | 6.02656266342615 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .data | 0x3000 | 0x3eb10 | 0x3ec00 | 454de6321f3862ae7d413163eae1d781 | False | 0.9868455864043825 | data | 7.996663236311901 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0x42000 | 0x2d0 | 0x400 | c21c59646630f5eb61510c7eddaca0ba | False | 0.3046875 | SysEx File - PalmTree | 3.034549702627992 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .pdata | 0x43000 | 0x21c | 0x400 | 66906a84b4648d7bf40a0990306889bd | False | 0.30859375 | data | 2.538723940112595 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .xdata | 0x44000 | 0x1a8 | 0x200 | 824eb5e2c7ac801453ef1cb7eb2f6f36 | False | 0.396484375 | data | 3.773379184135226 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .bss | 0x45000 | 0xe0 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .edata | 0x46000 | 0x44 | 0x200 | f169a4118c3d97251f615ae507476e4c | False | 0.126953125 | data | 0.7488638911136207 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .idata | 0x47000 | 0x368 | 0x400 | 3e867741b92470d9e2567176d80b2eff | False | 0.34765625 | data | 3.4698558599248295 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .CRT | 0x48000 | 0x58 | 0x200 | 6ff5386daed93bbd1da1f406c45de42b | False | 0.05859375 | data | 0.25323120180391656 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x49000 | 0x10 | 0x200 | bf619eac0cdf3f68d496ea9344137e8b | False | 0.02734375 | data | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .reloc | 0x4a000 | 0x5c | 0x200 | 02d981ee66f68254a25fff07cccdeb7a | False | 0.1796875 | data | 1.0043269309123346 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| DLL | Import |
|---|---|
| KERNEL32.dll | DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, Sleep, TlsGetValue, VirtualProtect, VirtualQuery |
| msvcrt.dll | __iob_func, _amsg_exit, _initterm, _lock, _unlock, abort, calloc, free, fwrite, realloc, strlen, strncmp, vfprintf |
| Name | Ordinal | Address |
|---|---|---|
| main | 1 | 0x205d525e0 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 28, 2024 13:37:57.789480925 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:57.789513111 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:57.789572001 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:57.804466009 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:57.804506063 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:57.804563999 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:57.828502893 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:57.828516006 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:57.838118076 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:57.838135004 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.701853037 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.701987982 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.704580069 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.704668045 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.778304100 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.778316975 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.779361010 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.779426098 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.781238079 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.795020103 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.795042992 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.795346022 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.795386076 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.797826052 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:58.824496984 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:58.844494104 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.126604080 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.126682043 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.126866102 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.127101898 CEST | 49731 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.127115011 CEST | 443 | 49731 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.142712116 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.142791986 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.142802954 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.142863035 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.142877102 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.142904997 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.143062115 CEST | 49730 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.143074036 CEST | 443 | 49730 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.155944109 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.155966997 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.156063080 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.156255960 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.156269073 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.157063007 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.157078028 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.157160997 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.157316923 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.157326937 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.940629959 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.940737009 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.960962057 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.961091995 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.961817026 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.961824894 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.963102102 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.963108063 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.963488102 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.963496923 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:37:59.964533091 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:37:59.964538097 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.371902943 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.371997118 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.372020960 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.372036934 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.372075081 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.372093916 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.382185936 CEST | 49732 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.382205009 CEST | 443 | 49732 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.397471905 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.397541046 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.397546053 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.397592068 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.399027109 CEST | 49733 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.399043083 CEST | 443 | 49733 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.539830923 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.539885044 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:00.539987087 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.545834064 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:00.545846939 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.466993093 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.467093945 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.540112972 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.540142059 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.540527105 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.540683031 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.542192936 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.588511944 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.920270920 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.920380116 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.920418978 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.920445919 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.920463085 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.920494080 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.920845032 CEST | 49734 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.920866013 CEST | 443 | 49734 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.922096968 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.922138929 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:01.922239065 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.922471046 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:01.922487974 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:02.739522934 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:02.739720106 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:02.756964922 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:02.756974936 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:02.797823906 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:02.797846079 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:03.188900948 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:03.188961983 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:03.188977957 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:03.188993931 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:03.189023972 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:03.189045906 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:03.225919008 CEST | 49735 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:03.225940943 CEST | 443 | 49735 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:23.301357985 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:23.301399946 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:23.301475048 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:23.301712036 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:23.301728010 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:24.114377022 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:24.114528894 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:24.115145922 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:24.115158081 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:24.124083996 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:24.124092102 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:24.551552057 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:24.551640034 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:24.551654100 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:24.551701069 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:24.551721096 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:24.551764011 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:24.552395105 CEST | 49742 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:24.552408934 CEST | 443 | 49742 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:29.709765911 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:29.709791899 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:29.709852934 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:29.710675001 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:29.710691929 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:29.710750103 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:29.717107058 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:29.717122078 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:29.717344046 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:29.717355967 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:30.722275972 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:30.722368002 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:30.722882032 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:30.722887039 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:30.731131077 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:30.731136084 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:30.744163036 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:30.744271994 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:30.744647026 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:30.744658947 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:30.752723932 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:30.752728939 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:31.158726931 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:31.158787012 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:31.158834934 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:31.158885002 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:31.159097910 CEST | 49744 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:31.159106970 CEST | 443 | 49744 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:31.192913055 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:31.193003893 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:31.193015099 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:31.193054914 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:31.193237066 CEST | 49743 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:31.193247080 CEST | 443 | 49743 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:36.575401068 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:36.575409889 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:36.575602055 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:36.575833082 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:36.575845003 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:37.385302067 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:37.385374069 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:37.385886908 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:37.385891914 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:37.387120008 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:37.387131929 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:37.837740898 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:37.837826014 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:37.837835073 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:37.837881088 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:37.837899923 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:37.837980032 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:38.080738068 CEST | 49745 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:38.080754995 CEST | 443 | 49745 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:59.295489073 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:59.295526981 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:38:59.295595884 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:59.296138048 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:38:59.296149969 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:00.118809938 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:00.118900061 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:00.120098114 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:00.120104074 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:00.121316910 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:00.121321917 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:00.574177980 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:00.574244976 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:00.574255943 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:00.574270010 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:00.574299097 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:00.574314117 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:00.575495958 CEST | 49747 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:00.575505972 CEST | 443 | 49747 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:01.185379028 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.185410023 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:01.185488939 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.185776949 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.185791016 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:01.247813940 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.247843981 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:01.247915030 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.248322964 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.248337984 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:01.979377985 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:01.979487896 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.980503082 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.980509043 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:01.984163046 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:01.984169006 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.051650047 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.051783085 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.052707911 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.052721024 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.055639029 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.055644989 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.412760973 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.412827969 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.412832975 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.412873983 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.413021088 CEST | 49748 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.413029909 CEST | 443 | 49748 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.497617006 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.497688055 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:02.497693062 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.497733116 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.497891903 CEST | 49749 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:02.497905970 CEST | 443 | 49749 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:15.810075998 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:15.810094118 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:15.810170889 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:15.810430050 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:15.810440063 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:16.637413025 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:16.637512922 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:16.638005972 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:16.638012886 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:16.639280081 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:16.639285088 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:17.135099888 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:17.135159016 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:17.135215044 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:17.135263920 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:17.135575056 CEST | 49750 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:17.135581970 CEST | 443 | 49750 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:31.434950113 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:31.434978008 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:31.435055017 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:31.435246944 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:31.435260057 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:31.572761059 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:31.572772980 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:31.572840929 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:31.573088884 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:31.573101044 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.388886929 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.388909101 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.388976097 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.389018059 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.389472961 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.389477015 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.389993906 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.389997959 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.390799999 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.390804052 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.393618107 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.393624067 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.821850061 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.821933985 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.821940899 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.821984053 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.822432995 CEST | 49751 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.822437048 CEST | 443 | 49751 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.823255062 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.823318005 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.823326111 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.823338985 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:32.823367119 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.823388100 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.823715925 CEST | 49752 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:32.823723078 CEST | 443 | 49752 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:46.221594095 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:46.221632004 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:46.221719027 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:46.222353935 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:46.222368956 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:47.045598030 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:47.045692921 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:47.046298027 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:47.046304941 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:47.047836065 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:47.047842026 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:47.497339010 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:47.497406006 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:47.497514963 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:47.497514963 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:47.497749090 CEST | 49753 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:47.497762918 CEST | 443 | 49753 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:52.857203007 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:52.857237101 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:52.857310057 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:52.857309103 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:52.857342005 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:52.857395887 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:52.857562065 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:52.857577085 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:52.857692957 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:52.857707024 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:53.664959908 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:53.665030956 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:53.665491104 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:53.665499926 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:53.666925907 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:53.666932106 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:53.686532021 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:53.686608076 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:53.687043905 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:53.687052011 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:53.688530922 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:53.688536882 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:54.110078096 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:54.110141039 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:54.110152960 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:54.110165119 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:54.110210896 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:54.110235929 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:54.110379934 CEST | 49754 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:54.110388994 CEST | 443 | 49754 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:54.142112970 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:54.142195940 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:39:54.142203093 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:54.142260075 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:54.142461061 CEST | 49755 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:39:54.142472029 CEST | 443 | 49755 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:00.497952938 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:00.497967958 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:00.498095036 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:00.498395920 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:00.498405933 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:01.280878067 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:01.280941010 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:01.281424999 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:01.281430960 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:01.282605886 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:01.282610893 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:01.711249113 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:01.711313009 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:01.711342096 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:01.711379051 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:01.711613894 CEST | 49756 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:01.711622000 CEST | 443 | 49756 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:19.735697031 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:19.735750914 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:19.735827923 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:19.736064911 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:19.736082077 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:20.556066036 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:20.556243896 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:20.556936979 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:20.556947947 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:20.558135986 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:20.558141947 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:20.992276907 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:20.992352962 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:20.992357969 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:20.992398024 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:20.992600918 CEST | 49757 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:20.992618084 CEST | 443 | 49757 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:21.122360945 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:21.122414112 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:21.122483969 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:21.122760057 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:21.122778893 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:21.169378042 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:21.169423103 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:21.169503927 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:21.169765949 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:21.169780016 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:22.891752958 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:22.891819954 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:22.892534018 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:22.892544985 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:22.894311905 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:22.894318104 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:22.897874117 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:22.897926092 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:22.898554087 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:22.898570061 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:22.900320053 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:22.900336981 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.334438086 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.334510088 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.334603071 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:23.334755898 CEST | 49758 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:23.334779024 CEST | 443 | 49758 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.340621948 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.340681076 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:23.340703964 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.341038942 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.341084003 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:23.341149092 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:23.341159105 CEST | 443 | 49759 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:23.341166019 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:23.341711044 CEST | 49759 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:46.028804064 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:46.028856039 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:46.028942108 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:46.029252052 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:46.029264927 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:46.824866056 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:46.824937105 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:46.825333118 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:46.825345993 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:46.826581955 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:46.826586962 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:47.270417929 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:47.270481110 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:47.270484924 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:47.270529032 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:47.270709991 CEST | 49760 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:47.270730019 CEST | 443 | 49760 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:52.341614962 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:52.341711998 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:52.341806889 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:52.342034101 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:52.342080116 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:52.356941938 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:52.356966972 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:52.357043982 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:52.357224941 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:52.357239008 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.150129080 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.150260925 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.150907993 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.150917053 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.154577017 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.154582977 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.163218975 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.163297892 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.163666964 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.163670063 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.164743900 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.164755106 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.600370884 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.600444078 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.600451946 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.600513935 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.600739002 CEST | 49761 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.600786924 CEST | 443 | 49761 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.610692978 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.610749006 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:40:53.610754013 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.610790014 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.610939026 CEST | 49762 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:40:53.610958099 CEST | 443 | 49762 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:07.294702053 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:07.294764996 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:07.294836998 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:07.295113087 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:07.295128107 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:08.091916084 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:08.092010021 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:08.136085987 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:08.136101007 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:08.137770891 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:08.137779951 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:08.536794901 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:08.536848068 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:08.536967039 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:08.537048101 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:08.537689924 CEST | 49763 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:08.537703037 CEST | 443 | 49763 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:18.607125998 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:18.607258081 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:18.607364893 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:18.607887983 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:18.607925892 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:18.622384071 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:18.622446060 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:18.622529984 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:18.622920036 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:18.622932911 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.442564964 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.442744017 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.444420099 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.444428921 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.445741892 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.445748091 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.446244955 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.446338892 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.446603060 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.446634054 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.447731972 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.447745085 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.880333900 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.880386114 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.880390882 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.880425930 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.880681038 CEST | 49765 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.880698919 CEST | 443 | 49765 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.899460077 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.899518967 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:19.899524927 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.899559975 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.899755955 CEST | 49764 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:19.899772882 CEST | 443 | 49764 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:32.576462984 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:32.576500893 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:32.576576948 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:32.577121973 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:32.577132940 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:33.388235092 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:33.388312101 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:33.389719009 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:33.389725924 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:33.390986919 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:33.390991926 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:33.852284908 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:33.852344036 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:33.852520943 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:33.852847099 CEST | 49766 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:33.852860928 CEST | 443 | 49766 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:48.914560080 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:48.914664984 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:48.914894104 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:48.915496111 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:48.915529966 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:48.935494900 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:48.935522079 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:48.935597897 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:48.935898066 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:48.935920954 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:49.737180948 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:49.737329006 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:49.738965988 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:49.738987923 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:49.742856979 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:49.742872000 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:49.763701916 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:49.763921022 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:49.764777899 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:49.764792919 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:49.768146992 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:49.768157005 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.192914009 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.192969084 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.193182945 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:50.193218946 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:50.193265915 CEST | 49767 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:50.193295002 CEST | 443 | 49767 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.215239048 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.215305090 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:50.215348959 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.215400934 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:50.215497017 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:50.215500116 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.215543985 CEST | 443 | 49768 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:50.215553999 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:50.215595961 CEST | 49768 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:59.873104095 CEST | 49769 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:59.873138905 CEST | 443 | 49769 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:41:59.873219013 CEST | 49769 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:59.873476028 CEST | 49769 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:41:59.873486996 CEST | 443 | 49769 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:42:00.679550886 CEST | 443 | 49769 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:42:00.682044029 CEST | 49769 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:42:00.682941914 CEST | 49769 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:42:00.682954073 CEST | 443 | 49769 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:42:00.684415102 CEST | 49769 | 443 | 192.168.2.4 | 43.206.237.192 |
| Aug 28, 2024 13:42:00.684420109 CEST | 443 | 49769 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:42:01.121143103 CEST | 443 | 49769 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:42:01.121200085 CEST | 443 | 49769 | 43.206.237.192 | 192.168.2.4 |
| Aug 28, 2024 13:42:01.121272087 CEST | 49769 | 443 | 192.168.2.4 | 43.206.237.192 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 28, 2024 13:37:57.760030985 CEST | 53366 | 53 | 192.168.2.4 | 1.1.1.1 |
| Aug 28, 2024 13:37:57.771446943 CEST | 53 | 53366 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Aug 28, 2024 13:37:57.760030985 CEST | 192.168.2.4 | 1.1.1.1 | 0x5aa8 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Aug 28, 2024 13:37:57.771446943 CEST | 1.1.1.1 | 192.168.2.4 | 0x5aa8 | No error (0) | 43.206.237.192 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:37:58 UTC | 251 | OUT | |
| 2024-08-28 11:37:58 UTC | 538 | OUT | |
| 2024-08-28 11:37:59 UTC | 168 | IN | |
| 2024-08-28 11:37:59 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49731 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:37:58 UTC | 251 | OUT | |
| 2024-08-28 11:37:58 UTC | 538 | OUT | |
| 2024-08-28 11:37:59 UTC | 168 | IN | |
| 2024-08-28 11:37:59 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49732 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:37:59 UTC | 250 | OUT | |
| 2024-08-28 11:37:59 UTC | 96 | OUT | |
| 2024-08-28 11:38:00 UTC | 168 | IN | |
| 2024-08-28 11:38:00 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49733 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:37:59 UTC | 250 | OUT | |
| 2024-08-28 11:37:59 UTC | 96 | OUT | |
| 2024-08-28 11:38:00 UTC | 168 | IN | |
| 2024-08-28 11:38:00 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49734 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:38:01 UTC | 251 | OUT | |
| 2024-08-28 11:38:01 UTC | 538 | OUT | |
| 2024-08-28 11:38:01 UTC | 168 | IN | |
| 2024-08-28 11:38:01 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49735 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:38:02 UTC | 250 | OUT | |
| 2024-08-28 11:38:02 UTC | 96 | OUT | |
| 2024-08-28 11:38:03 UTC | 168 | IN | |
| 2024-08-28 11:38:03 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49742 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:38:24 UTC | 250 | OUT | |
| 2024-08-28 11:38:24 UTC | 96 | OUT | |
| 2024-08-28 11:38:24 UTC | 168 | IN | |
| 2024-08-28 11:38:24 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49744 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:38:30 UTC | 250 | OUT | |
| 2024-08-28 11:38:30 UTC | 96 | OUT | |
| 2024-08-28 11:38:31 UTC | 168 | IN | |
| 2024-08-28 11:38:31 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49743 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:38:30 UTC | 250 | OUT | |
| 2024-08-28 11:38:30 UTC | 96 | OUT | |
| 2024-08-28 11:38:31 UTC | 168 | IN | |
| 2024-08-28 11:38:31 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49745 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:38:37 UTC | 250 | OUT | |
| 2024-08-28 11:38:37 UTC | 96 | OUT | |
| 2024-08-28 11:38:37 UTC | 168 | IN | |
| 2024-08-28 11:38:37 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49747 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:00 UTC | 250 | OUT | |
| 2024-08-28 11:39:00 UTC | 96 | OUT | |
| 2024-08-28 11:39:00 UTC | 168 | IN | |
| 2024-08-28 11:39:00 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.4 | 49748 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:01 UTC | 250 | OUT | |
| 2024-08-28 11:39:01 UTC | 96 | OUT | |
| 2024-08-28 11:39:02 UTC | 168 | IN | |
| 2024-08-28 11:39:02 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.4 | 49749 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:02 UTC | 250 | OUT | |
| 2024-08-28 11:39:02 UTC | 96 | OUT | |
| 2024-08-28 11:39:02 UTC | 168 | IN | |
| 2024-08-28 11:39:02 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.4 | 49750 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:16 UTC | 250 | OUT | |
| 2024-08-28 11:39:16 UTC | 96 | OUT | |
| 2024-08-28 11:39:17 UTC | 168 | IN | |
| 2024-08-28 11:39:17 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.4 | 49751 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:32 UTC | 250 | OUT | |
| 2024-08-28 11:39:32 UTC | 96 | OUT | |
| 2024-08-28 11:39:32 UTC | 168 | IN | |
| 2024-08-28 11:39:32 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.4 | 49752 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:32 UTC | 250 | OUT | |
| 2024-08-28 11:39:32 UTC | 96 | OUT | |
| 2024-08-28 11:39:32 UTC | 168 | IN | |
| 2024-08-28 11:39:32 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.4 | 49753 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:47 UTC | 250 | OUT | |
| 2024-08-28 11:39:47 UTC | 96 | OUT | |
| 2024-08-28 11:39:47 UTC | 168 | IN | |
| 2024-08-28 11:39:47 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.4 | 49754 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:53 UTC | 250 | OUT | |
| 2024-08-28 11:39:53 UTC | 96 | OUT | |
| 2024-08-28 11:39:54 UTC | 168 | IN | |
| 2024-08-28 11:39:54 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.4 | 49755 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:39:53 UTC | 250 | OUT | |
| 2024-08-28 11:39:53 UTC | 96 | OUT | |
| 2024-08-28 11:39:54 UTC | 168 | IN | |
| 2024-08-28 11:39:54 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.4 | 49756 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:40:01 UTC | 250 | OUT | |
| 2024-08-28 11:40:01 UTC | 96 | OUT | |
| 2024-08-28 11:40:01 UTC | 168 | IN | |
| 2024-08-28 11:40:01 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.4 | 49757 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:40:20 UTC | 250 | OUT | |
| 2024-08-28 11:40:20 UTC | 96 | OUT | |
| 2024-08-28 11:40:20 UTC | 168 | IN | |
| 2024-08-28 11:40:20 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.4 | 49759 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:40:22 UTC | 250 | OUT | |
| 2024-08-28 11:40:22 UTC | 96 | OUT | |
| 2024-08-28 11:40:23 UTC | 168 | IN | |
| 2024-08-28 11:40:23 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.4 | 49758 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:40:22 UTC | 250 | OUT | |
| 2024-08-28 11:40:22 UTC | 96 | OUT | |
| 2024-08-28 11:40:23 UTC | 168 | IN | |
| 2024-08-28 11:40:23 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.4 | 49760 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:40:46 UTC | 250 | OUT | |
| 2024-08-28 11:40:46 UTC | 96 | OUT | |
| 2024-08-28 11:40:47 UTC | 168 | IN | |
| 2024-08-28 11:40:47 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.4 | 49761 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:40:53 UTC | 250 | OUT | |
| 2024-08-28 11:40:53 UTC | 96 | OUT | |
| 2024-08-28 11:40:53 UTC | 168 | IN | |
| 2024-08-28 11:40:53 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.4 | 49762 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:40:53 UTC | 250 | OUT | |
| 2024-08-28 11:40:53 UTC | 96 | OUT | |
| 2024-08-28 11:40:53 UTC | 168 | IN | |
| 2024-08-28 11:40:53 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.4 | 49763 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:41:08 UTC | 250 | OUT | |
| 2024-08-28 11:41:08 UTC | 96 | OUT | |
| 2024-08-28 11:41:08 UTC | 168 | IN | |
| 2024-08-28 11:41:08 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 27 | 192.168.2.4 | 49765 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:41:19 UTC | 250 | OUT | |
| 2024-08-28 11:41:19 UTC | 96 | OUT | |
| 2024-08-28 11:41:19 UTC | 168 | IN | |
| 2024-08-28 11:41:19 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 28 | 192.168.2.4 | 49764 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:41:19 UTC | 250 | OUT | |
| 2024-08-28 11:41:19 UTC | 96 | OUT | |
| 2024-08-28 11:41:19 UTC | 168 | IN | |
| 2024-08-28 11:41:19 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 29 | 192.168.2.4 | 49766 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:41:33 UTC | 250 | OUT | |
| 2024-08-28 11:41:33 UTC | 96 | OUT | |
| 2024-08-28 11:41:33 UTC | 168 | IN | |
| 2024-08-28 11:41:33 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 30 | 192.168.2.4 | 49767 | 43.206.237.192 | 443 | 7372 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:41:49 UTC | 250 | OUT | |
| 2024-08-28 11:41:49 UTC | 96 | OUT | |
| 2024-08-28 11:41:50 UTC | 168 | IN | |
| 2024-08-28 11:41:50 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 31 | 192.168.2.4 | 49768 | 43.206.237.192 | 443 | 7396 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:41:49 UTC | 250 | OUT | |
| 2024-08-28 11:41:49 UTC | 96 | OUT | |
| 2024-08-28 11:41:50 UTC | 168 | IN | |
| 2024-08-28 11:41:50 UTC | 14 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 32 | 192.168.2.4 | 49769 | 43.206.237.192 | 443 | 7500 | C:\Windows\System32\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-28 11:42:00 UTC | 250 | OUT | |
| 2024-08-28 11:42:00 UTC | 96 | OUT | |
| 2024-08-28 11:42:01 UTC | 168 | IN | |
| 2024-08-28 11:42:01 UTC | 14 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 07:37:54 |
| Start date: | 28/08/2024 |
| Path: | C:\Windows\System32\loaddll64.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff697fd0000 |
| File size: | 165'888 bytes |
| MD5 hash: | 763455F9DCB24DFEECC2B9D9F8D46D52 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 07:37:54 |
| Start date: | 28/08/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 2 |
| Start time: | 07:37:54 |
| Start date: | 28/08/2024 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff749ee0000 |
| File size: | 289'792 bytes |
| MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 07:37:54 |
| Start date: | 28/08/2024 |
| Path: | C:\Windows\System32\rundll32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff73f1e0000 |
| File size: | 71'680 bytes |
| MD5 hash: | EF3179D498793BF4234F708D3BE28633 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 07:37:54 |
| Start date: | 28/08/2024 |
| Path: | C:\Windows\System32\rundll32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff73f1e0000 |
| File size: | 71'680 bytes |
| MD5 hash: | EF3179D498793BF4234F708D3BE28633 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 5 |
| Start time: | 07:37:57 |
| Start date: | 28/08/2024 |
| Path: | C:\Windows\System32\rundll32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff73f1e0000 |
| File size: | 71'680 bytes |
| MD5 hash: | EF3179D498793BF4234F708D3BE28633 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 14.9% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 83 |
| Total number of Limit Nodes: | 0 |
Graph
Callgraph
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFE13301590 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 120COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 3.8% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 4.7% |
| Total number of Nodes: | 488 |
| Total number of Limit Nodes: | 9 |
Graph
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001E8C875CAD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 198processthreadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001E8C874D5C0 Relevance: 1.6, APIs: 1, Instructions: 114libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001E8C8747520 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 372COMMON
Download Yara Rule
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000001E8C8749500 Relevance: 1.9, APIs: 1, Instructions: 409synchronizationCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|