Play interactive tour
Edit tourAnalysis Report onerous.tar.dll
Overview
General Information
| Sample Name: | onerous.tar.dll |
| Analysis ID: | 322295 |
| MD5: | 79d81979dbbd1c8ceb04cc80a903ecd1 |
| SHA1: | f40959018e132fb1430f77a26903af222244676c |
| SHA256: | 5dd2f21b81330a342fe1bb9a17a8fde423928e266d4842887f8b41e5d7c2fbd6 |
| Tags: | dll |
Most interesting Screenshot:  | |
Detection
Gozi Ursnif
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Detected Gozi e-Banking trojan
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
Yara detected Ursnif
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Compiles code for process injection (via .Net compiler)
Creates a COM Internet Explorer object
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Found Tor onion address
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious Csc.exe Source File Folder
Suspicious powershell command line found
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Compiles C# or VB.Net code
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file does not import any functions
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
Startup |
|---|
|
Malware Configuration |
|---|
Threatname: Ursnif |
|---|
{"server": "730", "os": "10.0_0_0_x64", "version": "250157", "uptime": "158", "system": "75b51dd63c757ef7e1ccbbde1d12750dhh%`", "size": "200775", "crc": "2", "action": "00000000", "id": "1100", "time": "1606281604", "user": "f73be0088695dc15e71ab15cb33c1faf", "hash": "0xa9e7194b", "soft": "3"}Yara Overview |
|---|
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| Click to see the 12 entries | ||||
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Dot net compiler compiles file from suspicious location | Show sources | ||
| Source: | Author: Joe Security: | ||
| Sigma detected: MSHTA Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag: | ||
| Sigma detected: Suspicious Csc.exe Source File Folder | Show sources | ||
| Source: | Author: Florian Roth: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Antivirus / Scanner detection for submitted sample | Show sources | ||
| Source: | Avira: | ||
| Found malware configuration | Show sources | ||
| Source: | Malware Configuration Extractor: | ||
| Multi AV Scanner detection for domain / URL | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Machine Learning detection for sample | Show sources | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Code function: | 0_2_00458A61 | |
| Source: | Code function: | 0_2_00443DEE | |
| Source: | Code function: | 0_2_00456E86 | |
| Source: | Code function: | 0_2_00461C05 | |
Networking: | |
|---|
| Creates a COM Internet Explorer object | Show sources | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Found Tor onion address | Show sources | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
Key, Mouse, Clipboard, Microphone and Screen Capturing: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
E-Banking Fraud: | |
|---|
| Detected Gozi e-Banking trojan | Show sources | ||
| Source: | Code function: | 0_2_004531EC | |
| Source: | Code function: | 0_2_004531EC | |
| Source: | Code function: | 0_2_004531EC | |
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Disables SPDY (HTTP compression, likely to perform web injects) | Show sources | ||
| Source: | Registry key value created / modified: | ||
System Summary: | |
|---|
| Writes or reads registry keys via WMI | Show sources | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Writes registry values via WMI | Show sources | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Code function: | 0_2_73751CEF | |
| Source: | Code function: | 0_2_737515AB | |
| Source: | Code function: | 0_2_73751880 | |
| Source: | Code function: | 0_2_737524C5 | |
| Source: | Code function: | 0_2_0044B868 | |
| Source: | Code function: | 0_2_00461813 | |
| Source: | Code function: | 0_2_00446825 | |
| Source: | Code function: | 0_2_00453A77 | |
| Source: | Code function: | 0_2_0045620F | |
| Source: | Code function: | 0_2_0045A3DE | |
| Source: | Code function: | 0_2_0046345F | |
| Source: | Code function: | 0_2_00462557 | |
| Source: | Code function: | 0_2_00441D18 | |
| Source: | Code function: | 0_2_0044C536 | |
| Source: | Code function: | 0_2_0045865A | |
| Source: | Code function: | 0_2_0044976D | |
| Source: | Code function: | 0_2_00450084 | |
| Source: | Code function: | 0_2_00465A8E | |
| Source: | Code function: | 0_2_0045AAB7 | |
| Source: | Code function: | 0_2_00444C96 | |
| Source: | Code function: | 0_2_00457511 | |
| Source: | Code function: | 0_2_00442D26 | |
| Source: | Code function: | 0_2_00448DAA | |
| Source: | Code function: | 0_2_00446F11 | |
| Source: | Code function: | 35_2_00FB387C | |
| Source: | Code function: | 35_2_00FB3830 | |
| Source: | Code function: | 35_2_00FB1AC4 | |
| Source: | Code function: | 35_2_00FABAB4 | |
| Source: | Code function: | 35_2_00FACCA0 | |
| Source: | Code function: | 35_2_00FCADD4 | |
| Source: | Code function: | 35_2_00FBF560 | |
| Source: | Code function: | 35_2_00FCF7EC | |
| Source: | Code function: | 35_2_00FBFFCC | |
| Source: | Code function: | 35_2_00FC676C | |
| Source: | Code function: | 35_2_00FE1002 | |
| Source: | Code function: | 0_2_00442F65 | |
| Source: | Code function: | 0_3_00432161 | |
| Source: | Code function: | 0_3_00431AE4 | |
| Source: | Code function: | 0_2_737522A4 | |
| Source: | Code function: | 0_2_0047181A | |
| Source: | Code function: | 0_2_0045F9C9 | |
| Source: | Code function: | 0_2_004491D8 | |
| Source: | Code function: | 0_2_0044A235 | |
| Source: | Code function: | 0_2_004562B9 | |
| Source: | Code function: | 0_2_00447CF0 | |
| Source: | Code function: | 0_2_00451481 | |
| Source: | Code function: | 0_2_0045C53B | |
| Source: | Code function: | 0_2_0045BDD5 | |
| Source: | Code function: | 0_2_0044DE6E | |
| Source: | Code function: | 0_2_00459F48 | |
| Source: | Code function: | 0_2_00466F28 | |
| Source: | Code function: | 35_2_00FCC164 | |
| Source: | Code function: | 35_2_00FCA4BC | |
| Source: | Code function: | 35_2_00FC676C | |
| Source: | Code function: | 35_2_00FC20F8 | |
| Source: | Code function: | 35_2_00FCE080 | |
| Source: | Code function: | 35_2_00FC6064 | |
| Source: | Code function: | 35_2_00FBB040 | |
| Source: | Code function: | 35_2_00FA203C | |
| Source: | Code function: | 35_2_00FC0034 | |
| Source: | Code function: | 35_2_00FC91A0 | |
| Source: | Code function: | 35_2_00FB1174 | |
| Source: | Code function: | 35_2_00FCF940 | |
| Source: | Code function: | 35_2_00FB9138 | |
| Source: | Code function: | 35_2_00FAC134 | |
| Source: | Code function: | 35_2_00FC8224 | |
| Source: | Code function: | 35_2_00FC3208 | |
| Source: | Code function: | 35_2_00FA2BC8 | |
| Source: | Code function: | 35_2_00FB9380 | |
| Source: | Code function: | 35_2_00FA8B5C | |
| Source: | Code function: | 35_2_00FB8B4C | |
| Source: | Code function: | 35_2_00FA7320 | |
| Source: | Code function: | 35_2_00FABCF8 | |
| Source: | Code function: | 35_2_00FB3CE0 | |
| Source: | Code function: | 35_2_00FC74CC | |
| Source: | Code function: | 35_2_00FB0CC0 | |
| Source: | Code function: | 35_2_00FC94B8 | |
| Source: | Code function: | 35_2_00FB9CB0 | |
| Source: | Code function: | 35_2_00FBD4A8 | |
| Source: | Code function: | 35_2_00FAD460 | |
| Source: | Code function: | 35_2_00FB1D94 | |
| Source: | Code function: | 35_2_00FB452C | |
| Source: | Code function: | 35_2_00FBB520 | |
| Source: | Code function: | 35_2_00FCB516 | |
| Source: | Code function: | 35_2_00FA6D08 | |
| Source: | Code function: | 35_2_00FC26B4 | |
| Source: | Code function: | 35_2_00FCBEB0 | |
| Source: | Code function: | 35_2_00FAAE04 | |
| Source: | Code function: | 35_2_00FA37B8 | |
| Source: | Code function: | 35_2_00FB17B8 | |
| Source: | Code function: | 35_2_00FCAFB8 | |
| Source: | Code function: | 35_2_00FA9F98 | |
| Source: | Code function: | 35_2_00FBF770 | |
| Source: | Code function: | 35_2_00FAB75C | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00443861 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | String found in binary or memory: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation: | |
|---|
| Suspicious powershell command line found | Show sources | ||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_0045735C | |
| Source: | Code function: | 0_3_0043AE33 | |
| Source: | Code function: | 0_3_0043AE35 | |
| Source: | Code function: | 0_3_00431AE3 | |
| Source: | Code function: | 0_3_00431A89 | |
| Source: | Code function: | 0_3_0043AF93 | |
| Source: | Code function: | 0_2_73752249 | |
| Source: | Code function: | 0_2_737522A3 | |
| Source: | Code function: | 0_2_0046B841 | |
| Source: | Code function: | 0_2_0046BAA1 | |
| Source: | Code function: | 0_2_00466BB9 | |
| Source: | Code function: | 0_2_00466F27 | |
| Source: | Code function: | 35_2_00FA4DD2 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Hooking and other Techniques for Hiding and Protection: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | File opened / queried: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Code function: | 0_2_00458A61 | |
| Source: | Code function: | 0_2_00443DEE | |
| Source: | Code function: | 0_2_00456E86 | |
| Source: | Code function: | 0_2_00461C05 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_0045735C | |
| Source: | Code function: | 0_3_0043040A | |
| Source: | Code function: | 0_3_004300B7 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_0045DA66 | |
HIPS / PFW / Operating System Protection Evasion: | |
|---|
| Allocates memory in foreign processes | Show sources | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | |||
| Changes memory attributes in foreign processes to executable or writable | Show sources | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Source: | Memory protected: | ||
| Compiles code for process injection (via .Net compiler) | Show sources | ||
| Source: | File written: | Jump to dropped file | ||
| Creates a thread in another existing process (thread injection) | Show sources | ||
| Source: | Thread created: | Jump to behavior | ||
| Source: | Thread created: | |||
| Source: | Thread created: | |||
| Source: | Thread created: | |||
| Source: | Thread created: | |||
| Source: | Thread created: | |||
| Injects code into the Windows Explorer (explorer.exe) | Show sources | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Maps a DLL or memory area into another process | Show sources | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Source: | Section loaded: | |||
| Modifies the context of a thread in another process (thread injection) | Show sources | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | Jump to behavior | ||
| Source: | Thread register set: | |||
| Source: | Thread register set: | |||
| Source: | Thread register set: | |||
| Source: | Thread register set: | |||
| Source: | Thread register set: | |||
| Writes to foreign memory regions | Show sources | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | |||
| Source: | Memory written: | |||
| Source: | Memory written: | |||
| Source: | Memory written: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00454270 | |
| Source: | Code function: | 0_2_737519DA | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_0044190E | |
| Source: | Code function: | 0_2_737513E4 | |
| Source: | Code function: | 0_2_0044B868 | |
| Source: | Code function: | 0_2_73751371 | |
| Source: | Key value queried: | ||
Stealing of Sensitive Information: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts1 | Windows Management Instrumentation2 | DLL Side-Loading1 | DLL Side-Loading1 | Obfuscated Files or Information1 | OS Credential Dumping | System Time Discovery1 | Remote Services | Archive Collected Data1 | Exfiltration Over Other Network Medium | Ingress Tool Transfer3 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Native API1 | Valid Accounts1 | Valid Accounts1 | DLL Side-Loading1 | LSASS Memory | Account Discovery1 | Remote Desktop Protocol | Email Collection1 | Exfiltration Over Bluetooth | Encrypted Channel1 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | Command and Scripting Interpreter12 | Logon Script (Windows) | Access Token Manipulation1 | Masquerading1 | Security Account Manager | File and Directory Discovery3 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Non-Application Layer Protocol3 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | PowerShell1 | Logon Script (Mac) | Process Injection813 | Valid Accounts1 | NTDS | System Information Discovery45 | Distributed Component Object Model | Input Capture | Scheduled Transfer | Application Layer Protocol3 | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Access Token Manipulation1 | LSA Secrets | Query Registry1 | SSH | Keylogging | Data Transfer Size Limits | Proxy1 | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | Virtualization/Sandbox Evasion3 | Cached Domain Credentials | Security Software Discovery11 | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Process Injection813 | DCSync | Virtualization/Sandbox Evasion3 | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact | |
| Drive-by Compromise | Command and Scripting Interpreter | Scheduled Task/Job | Scheduled Task/Job | Indicator Removal from Tools | Proc Filesystem | Process Discovery3 | Shared Webroot | Credential API Hooking | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Application Layer Protocol | Downgrade to Insecure Protocols | Generate Fraudulent Advertising Revenue | |
| Exploit Public-Facing Application | PowerShell | At (Linux) | At (Linux) | Masquerading | /etc/passwd and /etc/shadow | Application Window Discovery1 | Software Deployment Tools | Data Staged | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | Web Protocols | Rogue Cellular Base Station | Data Destruction | |
| Supply Chain Compromise | AppleScript | At (Windows) | At (Windows) | Invalid Code Signature | Network Sniffing | System Owner/User Discovery1 | Taint Shared Content | Local Data Staging | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | File Transfer Protocols | Data Encrypted for Impact |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 48% | Virustotal | Browse | ||
| 58% | ReversingLabs | Win32.Trojan.Razy | ||
| 100% | Avira | TR/Crypt.XDR.Gen | ||
| 100% | Joe Sandbox ML |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| c56.lepini.at | 47.241.19.44 | true | true |
| unknown |
| api10.laptok.at | 47.241.19.44 | true | false |
| unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| true |
| low | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| low | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
Contacted IPs |
|---|
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Red Diamond |
| Analysis ID: | 322295 |
| Start date: | 24.11.2020 |
| Start time: | 21:18:13 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 13m 36s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | onerous.tar.dll |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 38 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 2 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal100.bank.troj.evad.winDLL@25/54@4/2 |
| EGA Information: | Failed |
| HDC Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| Time | Type | Description |
|---|---|---|
| 21:20:19 | API Interceptor | |
| 21:20:44 | API Interceptor |
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 47.241.19.44 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| api10.laptok.at | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| c56.lepini.at | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| No context |
|---|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 29272 |
| Entropy (8bit): | 1.7738811488176964 |
| Encrypted: | false |
| SSDEEP: | 96:rHZMZ928cx9W8pLdt8pDpf8phANM8pGf827B:rHZMZ928cx9W8vt8Fpf8vANM8Yf8YB |
| MD5: | A3C986346E381979C8B7FF0E295E4A1C |
| SHA1: | E0C81809FAB44BA2F42D1BD0385210480A21747D |
| SHA-256: | F5360641C2C41DF8CB888BEA48789AACE3A6E0EB5E17AE74431EE61EE4121098 |
| SHA-512: | 7CAA977208364696DA94E56DED347DE330491EC529F0E41AF9717C431ED2EDB832268693761B9CEB2C91E7A30A377FF10891B87F4CB74209515935BB56D1BA4C |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 71272 |
| Entropy (8bit): | 2.0467308111060736 |
| Encrypted: | false |
| SSDEEP: | 192:rlZyZI299WRZtDfO1Mh3GtesD+tt6KmseKkSVOSGOCSmsiBhVtiv1mw1VrizY1hU:rruf9URLjzFGHaROKiDiRizpMzg |
| MD5: | 27CB7067349AD628F3167C98BE8BA56E |
| SHA1: | 67A8CBE516489D9A23666BB973040CA03FAD967C |
| SHA-256: | 523D34792AB0EA3E62C208306C40EB049E011004AB7ACE7044119938002D4940 |
| SHA-512: | E3DC29904BAB3F2D70906DD20D4BB327B9889933609224910B8083464A5F28A1E3B591F9E87EF78A9FDC7733D887598C7DB8D49B7438567C413B62E648A89736 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 27592 |
| Entropy (8bit): | 1.9191146948002127 |
| Encrypted: | false |
| SSDEEP: | 192:rrZBiQkz623kIFj52skWOMuYBvqtlvqLgA:r9J3bIhIYnuIvWvA |
| MD5: | C0D309DF982E079C8D13B71F3742CDE8 |
| SHA1: | 3C0C8B011F7D3A9FA4A918993249212EE98A2423 |
| SHA-256: | FB865E3D5572506172E428FF5C8181FEB5F7E5F691E4D34E9039FE0679C389C7 |
| SHA-512: | 4640038DD51D3FA19EDD5B646B28F46347FCB0812FB581850045D7EF4D362072CB8979925BAEED373A28C87FE5049CFA8426D043312BB7F4BD9C1704FA81B3A1 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 27600 |
| Entropy (8bit): | 1.9187028135850674 |
| Encrypted: | false |
| SSDEEP: | 192:rJZeQe6gkAFj520kWhMUY5INbW1I92NbfoA:r/bptAhIg6UwabO5bj |
| MD5: | 33231CC9EC2C9C3202D8F3B8BBAC1B9E |
| SHA1: | E6147AEC076FB9CC8BB3B211B31F3FC2D823E670 |
| SHA-256: | 535C6F8B2D99A2344A1E6103C675F9A4B3A60E6F443B0FA8335887837A347631 |
| SHA-512: | B840E17D440272F44B27FA64295E680F912E3EE3D5B6E16C5B39B350CA37C2DBEE9A25ED75E8DEE61C92A437863B6EA5E06C2AC5660D108653B5C32AA0087DE3 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 28692 |
| Entropy (8bit): | 1.9204507076447392 |
| Encrypted: | false |
| SSDEEP: | 192:rBXZiQHz6NkEFjB2ckWXM+Ylw3DlDNb1E3DlDNJr:rBJPHW2EhwI8+Mw35HE357 |
| MD5: | 6F4D8329020DDEA4354B398FF20C7AAE |
| SHA1: | 5BEF65ED9DD663598B49B2B8F730C056E48333C8 |
| SHA-256: | 93F57556211625DF04ABAC6D2EA6A1C267D8B02ECA56401612B13FF88D86D342 |
| SHA-512: | 7A0377926FB4764816F6B09F03C6CA046D1E8B19796DC8B17E8004B49B822B4FBE5EA482C7FF0DDC21D1BC6F5AD4A8A3878662863CCC21E4563910AB6436A4C0 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 28140 |
| Entropy (8bit): | 1.9188053866160313 |
| Encrypted: | false |
| SSDEEP: | 192:rAZLQH6dkWFjf2ukWVMwYNfYJwlfaYJX14A:rwkaGWhOKWwEgKxt1b |
| MD5: | E5DECC73807B0E0B79C71BACA4C7DB4B |
| SHA1: | DAA38D791EB71D2F9B44C59915522C46816C92BA |
| SHA-256: | 0950B5299958686489E3F258393C6AB71E732D7BE3C4FF041592E3BFD52B5694 |
| SHA-512: | C5ADB7661E65EA01343BDA5D49D7A77D784FC639D2C1E190989180EA9F03EF41765C181AC894BB613A7542E0AE45DC1883A80988938D7B2A9445749C65E9EDA9 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 656 |
| Entropy (8bit): | 5.077401580149026 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxOE0KdWpKdWX4nWimI002EtM3MHdNMNxOE0KdWpKdWX4nWimI00ObVbkt:2d6NxO+fK4SZHKd6NxO+fK4SZ76b |
| MD5: | 1BE4A1F7F451CEEBE27D331E3F75EB62 |
| SHA1: | 30BD0677580A78C32576AED6973579E27BB3439F |
| SHA-256: | F313CA1F1598B33E2116F6DB66C205BFF45876EB41BBB53653E8C4E063DFF943 |
| SHA-512: | E0337672D9644879ED87AA7592333F0F8EC0507587EB955A803FFD331E62F16BC9D671B8BC58B95954807DD1CA558F518A96AB3AF5907E563D83E7C724BE9DBE |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 653 |
| Entropy (8bit): | 5.093006023686203 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxe2ksDlxDlX4nWimI002EtM3MHdNMNxe2ksDlxDlX4nWimI00Obkak6Es:2d6Nxrp4SZHKd6Nxrp4SZ7Aa7b |
| MD5: | 8BA10CB684BCA2596B80CDF6672B8AED |
| SHA1: | E18BD4F47888E0B4E89B5A45FF4ED5A87C1C26D5 |
| SHA-256: | 04065D56E43CD36AA4E36B26061C33D534291B08879915E12D467328A8E06643 |
| SHA-512: | E8CE02D03D868CA8DA4B9555F3A336C5484B7D309E17CE9160767753023342ABC799942F058CC2CB07BD37BA07879138B91D6EFBF7A5F7B057880B74B149BB99 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 662 |
| Entropy (8bit): | 5.122194032135596 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxvL02Tp2TX4nWimI002EtM3MHdNMNxvL02Tp2TX4nWimI00ObmZEtMb:2d6NxvQ4SZHKd6NxvQ4SZ7mb |
| MD5: | 7CA8697F7CC6EB2AE1AD1DCDEFE99E45 |
| SHA1: | FE5A3DC46C2A5F559D395DF4A0E6D6140ED664E6 |
| SHA-256: | 8ADD093CCA9896A3CCD685494F209190B74DC4E66288CF2A2E2AE0E57D8C76D6 |
| SHA-512: | 63D1EF3DAC54A8D9D91E02C3DF271287DADD92828DD2BDCC28F52F4E3517F14F50462EDE89419D90D677606179E49F49D14D434AF7DE8DC9802D94F2CAADBB7A |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 647 |
| Entropy (8bit): | 5.087026282289658 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxi0OpOX4nWimI002EtM3MHdNMNxi0OpOX4nWimI00Obd5EtMb:2d6Nxh4SZHKd6Nxh4SZ7Jjb |
| MD5: | E94C54A3D22944401298F92C5A9D0942 |
| SHA1: | 7F64BAAE56143B754270302263834AF185A92FBF |
| SHA-256: | 620A689C180141218B225E5F23631CAD9435B50797B2D5CAC945AC1C4A404E29 |
| SHA-512: | 46E8F47A87D5F1275AF14672C277BE9D69870D55DC9DB5B458C324CFB9522A407A72DEA6608E1CFA8A61A8F6712A2B7916E9E0A7848CA04924AC1E9F54A9FE70 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 656 |
| Entropy (8bit): | 5.13628902919673 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxhGw02Tp2TX4nWimI002EtM3MHdNMNxhGw02Tp2TX4nWimI00Ob8K075t:2d6NxQP4SZHKd6NxQP4SZ7YKajb |
| MD5: | 22A263B499DB5D19998731111CA9B90D |
| SHA1: | 9EC32CAB0B18DC969117CE0D2F0D6363566E8565 |
| SHA-256: | 819997C6EE7A94F7A998BFC8DBA2FED8AF1B99F8A28627EFC98240852AF257B8 |
| SHA-512: | 968FC394F7C031CC69242270017636DE8273084EB7F7C0E330F35854BAD2D822472F0E94C255FD9E5A168805F55599668ADAB14E4FAF1BF677AC4FBA1E33D335 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 653 |
| Entropy (8bit): | 5.078062345810726 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNx0n0KdWpKdWX4nWimI002EtM3MHdNMNx0n0KdWpKdWX4nWimI00ObxEty:2d6Nx0rfK4SZHKd6Nx0rfK4SZ7nb |
| MD5: | 74D54AEF719C33D18E3B3ABB0CA5BAAC |
| SHA1: | A94F71BE8198C097B5E82DE0F1D3FD80A58CE94E |
| SHA-256: | 3106D23C3F43BBE6E7303878930A376216223BA71FB35F303300D38CDEC888F2 |
| SHA-512: | DD81C7461CE3FD8C7717E12132E790C26F8D9005E0AA2FAB0A69BC17A60B3E7889C2CF38779EBAE671EA708C4B9A122F92E1B2AF75685FDFABF4CE53D5303CE8 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 656 |
| Entropy (8bit): | 5.115180936428906 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxx0OpOX4nWimI002EtM3MHdNMNxx0OpKdWX4nWimI00Ob6Kq5EtMb:2d6NxW4SZHKd6NxoK4SZ7ob |
| MD5: | 663C96EF5063DF9CDE299E8DA5CBDBFF |
| SHA1: | 38F6EA7AC5756E43A0815E73D3A0D423E6927C5D |
| SHA-256: | 278F923B5FECB5C0405D1C6CEDC3BF5F5E73D21374EC8EB9D20683334295C3AD |
| SHA-512: | ABB0CDEA2F4E3C831A23745B711981E56F1036E50D7292BB22DF35ACE4EAA9125593E9EBF9268297B8EEFA95BE3EB805FBF1AC3A9161824F0D657F515C66C8C5 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 659 |
| Entropy (8bit): | 5.1243145832336445 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxcsUxUX4nWimI002EtM3MHdNMNxcsUxUX4nWimI00ObVEtMb:2d6Nxv4SZHKd6Nxv4SZ7Db |
| MD5: | ED9176B3D75A7C27CB5763C41A1AE91D |
| SHA1: | D1EB120E09624DB29FD74251D32DA4392A1E7F5C |
| SHA-256: | D585B4EEF70FA5D1E181D5789B46113207663E3820ADBF83DC2ADA049AD642D0 |
| SHA-512: | BD17014708F89A12410E90B0534A40A04719C2BC32738976BCC18EAAE2BD084177F44A8070829878BD0E7BD22A9EDC9B8625D87E2E9BE324B36C19DB8A5958AE |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 653 |
| Entropy (8bit): | 5.072911264014693 |
| Encrypted: | false |
| SSDEEP: | 12:TMHdNMNxfn0OpOX4nWimI002EtM3MHdNMNxfn0OpOX4nWimI00Obe5EtMb:2d6NxI4SZHKd6NxI4SZ7ijb |
| MD5: | 0BAE92F55D07580AACAF7BB17C6423C7 |
| SHA1: | 0327680EBC8E79B6C957F3116FC9A8A33C5EC000 |
| SHA-256: | ABB47EDD851CC71FB9D738D3B586FAE86FA4F430420874E1BD46D0B6481328DF |
| SHA-512: | A3F0F833843E1F5FF42019CDCBBA5870C0E52DB325DE3A7750AF2E1C36752EA7901E8B33C1BF77BEB096BB6E3CD376B1B4160557550F2F8AB93CC1A1A68610B4 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2400 |
| Entropy (8bit): | 5.975522616591464 |
| Encrypted: | false |
| SSDEEP: | 48:T2ECG/vT+XLMHbLRCI24UCknBdpK2jgPOKipWUlgrjDu5pODzMHxW:KECGT+XqLxwnBbK8WUlqqaHMHxW |
| MD5: | E69A66BA1BFF6972458D1BC41252EE98 |
| SHA1: | 262423E195EE52FE55A2FA3CCD97E9B6619117A5 |
| SHA-256: | F1D70F929CDCB80F5CD8AAE9F8A41AB63FA171F224206A020596F73E88E384B2 |
| SHA-512: | 5EBDB4B48518CD539BE0ED3CC3EE25996D14A8E473DD0F0261439BF04F416902E6ACDA45E00DEF009CAD129EBC4EAD09A791357AACC3B829C4973080783BEEA7 |
| Malicious: | false |
| IE Cache URL: | http://api10.laptok.at/api1/JmXqR48EV_2/Fj7krfHmz1m5r7/TqzrKRjj2RWEPmuZGbTA6/_2B_2FvhG_2BTX6K/ScV_2BId1l8xoRD/ZIKmgZ4Hr1ogBm_2Ft/cJTdN_2F0/sOkKUhNEij9EeyBjgxaS/fAWTeONzVOzjyGfrZxL/sesogOMoxfuQAI6mdY73Xa/BaJEnujvmw_2B/vRpLGOj_/2Bvahak4rScm4JpMfQfaO8m/3X9wT7Vyfk/qviTv3J0IbAJn2nUb/wbGIEFwb6Ch2/LDOx1illPXc/Hz_2BbvAx_2Fcr/j_0A_0DiinRm69PA4aJZ4/DJR7fgT5XYyNTfe4/_2FOY_2B_2/BAPo2cJ8YkUi/c |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 748 |
| Entropy (8bit): | 7.249606135668305 |
| Encrypted: | false |
| SSDEEP: | 12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE |
| MD5: | C4F558C4C8B56858F15C09037CD6625A |
| SHA1: | EE497CC061D6A7A59BB66DEFEA65F9A8145BA240 |
| SHA-256: | 39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781 |
| SHA-512: | D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44 |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/down.png |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4720 |
| Entropy (8bit): | 5.164796203267696 |
| Encrypted: | false |
| SSDEEP: | 96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk |
| MD5: | D65EC06F21C379C87040B83CC1ABAC6B |
| SHA1: | 208D0A0BB775661758394BE7E4AFB18357E46C8B |
| SHA-256: | A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F |
| SHA-512: | 8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/errorPageStrings.js |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2168 |
| Entropy (8bit): | 5.207912016937144 |
| Encrypted: | false |
| SSDEEP: | 24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6 |
| MD5: | F4FE1CB77E758E1BA56B8A8EC20417C5 |
| SHA1: | F4EDA06901EDB98633A686B11D02F4925F827BF0 |
| SHA-256: | 8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F |
| SHA-512: | 62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436 |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/ErrorPageTemplate.css |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 447 |
| Entropy (8bit): | 7.304718288205936 |
| Encrypted: | false |
| SSDEEP: | 12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R |
| MD5: | 26F971D87CA00E23BD2D064524AEF838 |
| SHA1: | 7440BEFF2F4F8FABC9315608A13BF26CABAD27D9 |
| SHA-256: | 1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D |
| SHA-512: | C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15 |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/bullet.png |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 338016 |
| Entropy (8bit): | 5.999979867333796 |
| Encrypted: | false |
| SSDEEP: | 6144:h7OGXHIEr+zisK8tb3/VKph5ur8FlLivxSZXKoWEPws/2ImLLW4Ytb31Zmqq:N1iis338p6r8lLi5ScrUwwjsC4YtbFYV |
| MD5: | AB868B345CA418AA4FACC6D46BD38178 |
| SHA1: | A0A4189DC35EF39534A2EE41980275348B7AA8EE |
| SHA-256: | DAA9372E5A21C9079A646855110C83154D77B5E6DF2F37E949EA8452ABC1EF27 |
| SHA-512: | 1AE9D9E1D1C2BB3972433EBCE0DB8CAEEDA67AA93D1C8F09452593D67E59936446486B47B0C0775DF26F484479EB79818FC1D05526C6556B132FACB08A2A9D9C |
| Malicious: | false |
| IE Cache URL: | http://api10.laptok.at/api1/tWZ_2FD2Squg/FT7ec2R_2BI/1SrQaK0cbnFssD/EhaYqhgMTbjcAChT30HF6/_2F5KOHdpMr1MDEw/8l5rivX8vq0IZvK/gytYP5KOz0bdswPdPN/6JGFOawx9/jpz_2BKRYx6fKknk6pLW/tx_2FYdaEgf9TmZuTdQ/f0Tk4GzxbBo7nnpsJmyPiM/W7szWBXzIZ6B_/2B8hrjTH/_2FrpOMZRaBZ4xFjuf_2BhE/JcjrUYnllh/M19_2FdjJ2_2FYdJX/M9eFNCYNWFr2/TTPz7w_2FLg/lSv_0A_0DYUGze/qKcuuFgLExC0zUYAUDG_2/FUUaL9urgqUlfkic/Xw_2BsrLR7ACrKS/P753hBNv6/xxdXe7 |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 453 |
| Entropy (8bit): | 5.019973044227213 |
| Encrypted: | false |
| SSDEEP: | 6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi |
| MD5: | 20F0110ED5E4E0D5384A496E4880139B |
| SHA1: | 51F5FC61D8BF19100DF0F8AADAA57FCD9C086255 |
| SHA-256: | 1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B |
| SHA-512: | 5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/background_gradient.jpg |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 12105 |
| Entropy (8bit): | 5.451485481468043 |
| Encrypted: | false |
| SSDEEP: | 192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f |
| MD5: | 9234071287E637F85D721463C488704C |
| SHA1: | CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152 |
| SHA-256: | 65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649 |
| SHA-512: | 87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384 |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/httpErrorPagesScripts.js |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 267700 |
| Entropy (8bit): | 5.999877808101812 |
| Encrypted: | false |
| SSDEEP: | 6144:0GtBeRO1EXAR18gvZYQhlTIorpKkFqBCf:/tgROGm1qEl9rpKhi |
| MD5: | BF32F421FA2847FAA8DB0BE9201BA6DE |
| SHA1: | FD7A60D7431272DD5906940F08933E9A86A4283B |
| SHA-256: | FCA7FA4DFFAD605B97E30A75F5847E54E1B16D89B13C2542ACA5B1208F400F9A |
| SHA-512: | 56E1D7C7AFF4A81EAF3209EA2F1812960260D8BDBC0DC3B3501D78C48FC978D8C431714063D98D1EEF2D88F47B32E45BD9F59596DCE4FC82DB54CFA382D32649 |
| Malicious: | false |
| IE Cache URL: | http://api10.laptok.at/api1/xhsUm_2FnLgTwvG2iPTzCM2/vNAfftmWrr/Tvwy_2F0fKctIG74m/lS8RNzQeC42n/3Mv4DrZmcsV/dPovDeCz_2Bns7/SzRlXKXDTcnNvTwVof3JC/9OHXqekyZyAtiU_2/FKiPw6K2S4WkVU2/jPZ3OPDfyBZIrPRMr3/FBdYtTIJr/eK7MjotByUG0UytbsrJ_/2BIobg6gkWRSCkFALiR/3H39hT7Vg1tNx00aR3HUuS/eyDURwI5Q5dTx/nK0Boek7/Pnsv74L6CwFu08_0A_0D5Cn/saoDbWMFDu/ABzmmLf_2BuodD1FH/_2Ftl0V1Zs5G/QPAAHiHJ/7 |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 6495 |
| Entropy (8bit): | 3.8998802417135856 |
| Encrypted: | false |
| SSDEEP: | 48:up4d0yV4VkBXvLutC5N9J/1a5TI7kZ3GUXn3GFa7K083GJehBu01kptk7KwyBwpM:uKp6yN9JaKktZX36a7x05hwW7RM |
| MD5: | F65C729DC2D457B7A1093813F1253192 |
| SHA1: | 5006C9B50108CF582BE308411B157574E5A893FC |
| SHA-256: | B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F |
| SHA-512: | 717AFF18F105F342103D36270D642CC17BD9921FF0DBC87E3E3C2D897F490F4ECFAB29CF998D6D99C4951C3EABB356FE759C3483A33704CE9FCC1F546EBCBBC7 |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/http_404.htm |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4113 |
| Entropy (8bit): | 7.9370830126943375 |
| Encrypted: | false |
| SSDEEP: | 96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL |
| MD5: | 5565250FCC163AA3A79F0B746416CE69 |
| SHA1: | B97CC66471FCDEE07D0EE36C7FB03F342C231F8F |
| SHA-256: | 51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859 |
| SHA-512: | E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134 |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/info_48.png |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11606 |
| Entropy (8bit): | 4.883977562702998 |
| Encrypted: | false |
| SSDEEP: | 192:Axoe5FpOMxoe5Pib4GVsm5emdKVFn3eGOVpN6K3bkkjo5HgkjDt4iWN3yBGHh9sO:6fib4GGVoGIpN6KQkj2Akjh4iUxs14fr |
| MD5: | 1F1446CE05A385817C3EF20CBD8B6E6A |
| SHA1: | 1E4B1EE5EFCA361C9FB5DC286DD7A99DEA31F33D |
| SHA-256: | 2BCEC12B7B67668569124FED0E0CEF2C1505B742F7AE2CF86C8544D07D59F2CE |
| SHA-512: | 252AD962C0E8023419D756A11F0DDF2622F71CBC9DAE31DC14D9C400607DF43030E90BCFBF2EE9B89782CC952E8FB2DADD7BDBBA3D31E33DA5A589A76B87C514 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64 |
| Entropy (8bit): | 0.9260988789684415 |
| Encrypted: | false |
| SSDEEP: | 3:Nlllulb/lj:NllUb/l |
| MD5: | 13AF6BE1CB30E2FB779EA728EE0A6D67 |
| SHA1: | F33581AC2C60B1F02C978D14DC220DCE57CC9562 |
| SHA-256: | 168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F |
| SHA-512: | 1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 402 |
| Entropy (8bit): | 5.038590946267481 |
| Encrypted: | false |
| SSDEEP: | 6:V/DsYLDS81zuJeMRSR7a1ehk1wJveJSSRa+rVSSRnA/fuHo8zy:V/DTLDfuC3jJWv9rV5nA/2IAy |
| MD5: | D318CFA6F0AA6A796C421A261F345F96 |
| SHA1: | 8CC7A3E861751CD586D810AB0747F9C909E7F051 |
| SHA-256: | F0AC8098FC8D2D55052F4EA57D9B57E17A7BF211C3B51F261C8194CECB6007E2 |
| SHA-512: | 10EB4A6982093BE06F7B4C15F2898F0C7645ECD7EFA64195A9940778BCDE81CF54139B3A65A1584025948E87C37FAF699BE0B4EB5D6DFAEC41CDCC25E0E7BDA8 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 369 |
| Entropy (8bit): | 5.313360961388429 |
| Encrypted: | false |
| SSDEEP: | 6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fe0Uzxs7+AEszIWXp+N23feSn:p37Lvkmb6KHqWZE8Pn |
| MD5: | 2DB8879E193202C9BF2E53E6BFED2AA0 |
| SHA1: | B70B1517052DE8E7C4936A6032542D18B2000AA0 |
| SHA-256: | 01A4228FF2F9F3B587C24468C7F3EE08DC64259C9BDC1E4FA0AD35F6BBDAB4B9 |
| SHA-512: | 495DF850BFE8CEB6CED15B037F6571F0CCBCB5B5EB3F21C2F40F3D7EE1F213CDD0BFC58E86AC054987284756E5765B4321DDDB1B71D7E4C177B27A263F6CA87B |
| Malicious: | true |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3584 |
| Entropy (8bit): | 2.6201282755446322 |
| Encrypted: | false |
| SSDEEP: | 24:etGSpW/W2Dg85xL/XsB4zJL4zqhRqPPtkZfGmNn+II+ycuZhNHakSpPNnq:6xWb5xL/OGbuuJlRn1ulHa3Lq |
| MD5: | A5F27D62E9CA8D216BD8677A014C1E9F |
| SHA1: | 48745A1788FDCCBF3BE6F7BEC72A926A28E1CA99 |
| SHA-256: | 623AB8A49F0ED911BF70DA44A71F47EBB1BDCE091A80B4C77EB25E60337D7451 |
| SHA-512: | E1849B68778B01881F8E4246BEDC113CBA95F483C0C9F38EA713F31635CA121515F65939B2D38DD0316DF44E9BED84C20B293CA351411042B1D455080A2F13D8 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 412 |
| Entropy (8bit): | 4.871364761010112 |
| Encrypted: | false |
| SSDEEP: | 12:zKaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:zKaM5DqBVKVrdFAMBJTH |
| MD5: | 83B3C9D9190CE2C57B83EEE13A9719DF |
| SHA1: | ABFAB07DEA88AF5D3AF75970E119FE44F43FE19E |
| SHA-256: | B5D219E5143716023566DD71C0195F41F32C3E7F30F24345E1708C391DEEEFDA |
| SHA-512: | 0DE42AC5924B8A8E977C1330E9D7151E9DCBB1892A038C1815321927DA3DB804EC13B129196B6BC84C7BFC9367C1571FCD128CCB0645EAC7418E39A91BC2FEDB |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 652 |
| Entropy (8bit): | 3.1156819456479257 |
| Encrypted: | false |
| SSDEEP: | 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryKfnGak7YnqqhfnXPN5Dlq5J:+RI+ycuZhNHakSpPNnqX |
| MD5: | 52FBC8B242036E953D34FB77648B8CA7 |
| SHA1: | 44B9D1FABA6237FD3EC21C1CB5EA552BE904EB25 |
| SHA-256: | A414B782A372D8D104F08A38DD596DA5D4F2A1A2E251EB596000D28CB6A808E2 |
| SHA-512: | 8C43DDC7C1A66790678DF83E8CC41C6DB731FFFB15EC5AD4F2DB0708DCF60D81B23853A04A0690D5B66D2F8212D8C9D280DD585DFCEC0C94ADDC165C3CF8EAB7 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 89 |
| Entropy (8bit): | 4.214875319651327 |
| Encrypted: | false |
| SSDEEP: | 3:oVXVPMfFfVQLU0qmW8JOGXnFPMfFfVQLU0Zun:o9QF9QLU0iqgF9QLU0Zu |
| MD5: | C761F30D7AA0B615632114F8048E36F6 |
| SHA1: | 0654CFC40DA2F1F93E8EF23E8E5BEF11ADC3FF8B |
| SHA-256: | 429DF2245415C117E29A61D8C318D5A8037D13458A0A326208BF1058A2FB91CB |
| SHA-512: | 1218CDFA05793495D3D26EBFBFBF759347DD4A4EC9E4660AD93262AE24D1913C583FBB0C0D7A51F6C0FCD6BD98474181F6E1847A1E577478FDBCB41320C21A03 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2184 |
| Entropy (8bit): | 2.70956465433161 |
| Encrypted: | false |
| SSDEEP: | 24:pgKLhHdVFhKdNNI+ycuZhNHakSpPNnq9qpnie9Ep:KK19VzKd31ulHa3Lq9uw |
| MD5: | F312FDCCB14F8E901F73C2077C51793C |
| SHA1: | 18ADB28339D8CE374944AD74AC42447CF8595A02 |
| SHA-256: | 07DE661EE9480141E11DC5B82CC0B16B6D632C83B8FB583C4879CAA09ACACA42 |
| SHA-512: | AB124BEA9705D985F3E573F8DC6C56DF6F3F88A2C4FE2F007022596498BC2C7EDF297DA91628EC7190EB9A27902BEE86F932226756048EF5CB8F087B75FC6BE0 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2184 |
| Entropy (8bit): | 2.7068645236556512 |
| Encrypted: | false |
| SSDEEP: | 24:bP6eRhHlhKdNNI+ycuZhNvuakScvPNnq9qpuhie9Ep:bPXDzKd31ulma3Sq93hw |
| MD5: | E50A6C8BC0F94622EB97ABF57EF8D1C6 |
| SHA1: | F5735A7C74B6CF1930CB6AF6F7FCC01EF275121D |
| SHA-256: | D18B307D5E7E38D78D1C0D868BEF19307AA4D60CDB225537773D740C8E1AC4A1 |
| SHA-512: | EFD48BEE39D7279CCDEBB0E867740D75D99A9053403E261A99C21FBA55F77BAC42618412F08C103A0A6C40685193EFCD5BA241035B3CB7F045CA30FB684A84F7 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:U:U |
| MD5: | C4CA4238A0B923820DCC509A6F75849B |
| SHA1: | 356A192B7913B04C54574D18C28D46E6395428AB |
| SHA-256: | 6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
| SHA-512: | 4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:U:U |
| MD5: | C4CA4238A0B923820DCC509A6F75849B |
| SHA1: | 356A192B7913B04C54574D18C28D46E6395428AB |
| SHA-256: | 6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
| SHA-512: | 4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 652 |
| Entropy (8bit): | 3.0849692938644355 |
| Encrypted: | false |
| SSDEEP: | 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grytuak7YnqqcvPN5Dlq5J:+RI+ycuZhNvuakScvPNnqX |
| MD5: | 94D1679D1D4FEFD1EF2E72D0E7ABF5B2 |
| SHA1: | AAC4640124B24ED06E8D7588C04AFCC9F534D707 |
| SHA-256: | 4C6512C3975A9BC03A4D0D45FF7274B75EFA247D42475BA3252FC6C288290AD5 |
| SHA-512: | FDA5BB5791C6634031BA7E0C3D6A98880059302323DFE0F0E3F973599C14789D7BBAE662A58E357704504C9CBAE38F429B2310AAC2332AFDEA51E7344AE4C09C |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 414 |
| Entropy (8bit): | 5.000775845755204 |
| Encrypted: | false |
| SSDEEP: | 6:V/DsYLDS81zuJ0VMRSRa+eNMjSSRr5DyBSRHq10iwHRfKFKDDVWQy:V/DTLDfue9eg5r5Xu0zH5rgQy |
| MD5: | 216105852331C904BA5D540DE538DD4E |
| SHA1: | EE80274EBF645987E942277F7E0DE23B51011752 |
| SHA-256: | 408944434D89B94CE4EB33DD507CA4E0283419FA39E016A5E26F2C827825DDCC |
| SHA-512: | 602208E375BCD655A21B2FC471C44892E26CA5BE9208B7C8EB431E27D3AAE5079A98DFFE3884A7FF9E46B24FFFC0F696CD468F09E57008A5EB5E8C4C93410B41 |
| Malicious: | true |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 369 |
| Entropy (8bit): | 5.236555817911529 |
| Encrypted: | false |
| SSDEEP: | 6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23f7ozxs7+AEszIWXp+N23f76An:p37Lvkmb6KHToWZE8Tl |
| MD5: | 9EA6B9D595456E5B23DEA4B11806F78F |
| SHA1: | C4487B9542B629D31FC73B8CADD37D6C4CDA53D1 |
| SHA-256: | D85066A82597D6622DE17EEC3E20F97C87204B48220F99A7B19899C0B663A34E |
| SHA-512: | 9D85F4C83ECA80E0BE1FB57842CB3E8FD85362ED3592850316B73F41BA7C018F0A5E7A62B08A3ACADEC7B29F2BEC2AF55C09D16F70333D6907E4EB441CBE5BA5 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3584 |
| Entropy (8bit): | 2.6244385522478124 |
| Encrypted: | false |
| SSDEEP: | 48:6AW7qMTxzJUyNjWQYwSJbYgH1ulma3Sq:SqYxAgWT44K |
| MD5: | 9E447BB5EA9933E1D20CB71DC2AC790A |
| SHA1: | C1D58647C580554A60A6027018CEE3C39143C2EE |
| SHA-256: | BA93835763E0E4FB5CFD4E71738E1E8205ED15F550E6E72848FFC8B9D7617FF9 |
| SHA-512: | D2461C61C6C837FE436AACC1E5A102D46DC316F96A00DA9554E3B9FF3E3F5D434427A10C6E01F8A063A841E5AF38D2458685FFB8017B413BBF8BC4FDDDF91A4B |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 412 |
| Entropy (8bit): | 4.871364761010112 |
| Encrypted: | false |
| SSDEEP: | 12:zKaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:zKaM5DqBVKVrdFAMBJTH |
| MD5: | 83B3C9D9190CE2C57B83EEE13A9719DF |
| SHA1: | ABFAB07DEA88AF5D3AF75970E119FE44F43FE19E |
| SHA-256: | B5D219E5143716023566DD71C0195F41F32C3E7F30F24345E1708C391DEEEFDA |
| SHA-512: | 0DE42AC5924B8A8E977C1330E9D7151E9DCBB1892A038C1815321927DA3DB804EC13B129196B6BC84C7BFC9367C1571FCD128CCB0645EAC7418E39A91BC2FEDB |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40233 |
| Entropy (8bit): | 0.6872617452706091 |
| Encrypted: | false |
| SSDEEP: | 192:kBqoxKAuqR+uoCLYpl23DlDNwl23DlDNrl23DlDNs:kBqoxKAuqR+uoCLYpw35qw35Vw35W |
| MD5: | A8F2EDC39A71827BE0EBE0795F23702B |
| SHA1: | 5CA5DDA74C4A1FA538C7E54A0EB745379DF3FA48 |
| SHA-256: | E63BCE665483F60D0B6135DFA320890A758390B6D3ACF556563187FF1CA23455 |
| SHA-512: | 22EC5CE2106255FAEDD494C61001762E6ACC217E6500F474F62FB0362BFE736B9031722DF1DE4677363870322B14FED15A06892EB1CAB88CFD86AA05A8603ADF |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40153 |
| Entropy (8bit): | 0.6723538040068409 |
| Encrypted: | false |
| SSDEEP: | 96:kBqoxKAuvScS+iEOnUVtj58MxzYJJtj58MxzYJatj58MxzYJP:kBqoxKAuqR+iEOnUVtdYJJtdYJatdYJP |
| MD5: | D072772A8EE6BB1D1F40D9F5810CFF5B |
| SHA1: | D59BFDF035410E69B594CE06D30CCA46732FA6CD |
| SHA-256: | 3F8E3C2F24061C4B5041DE82829E4B1ECABC0338722626233D521A0CE1FA869D |
| SHA-512: | 7C40C58BE6065EB2C39DBB0F7AB6EDF1A6079EDCA96483DB2E64702AD2CAC9AC23769DE290253614EE36BCB5771D3528D94F0AA78DF3AD1512AFB240BD221D36 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 12933 |
| Entropy (8bit): | 0.4099601119234265 |
| Encrypted: | false |
| SSDEEP: | 24:c9lLh9lLh9lIn9lIn9lo5F9lob9lW8pxh2:kBqoIci8pxh2 |
| MD5: | E5745EA6BA7E4FCBEBAC1A667C4DF152 |
| SHA1: | BC748E222B6BE84EC4F67D6E787E50FBAAFA5E84 |
| SHA-256: | F9BBCDB0B367EBB17FF40AFBDD2B55D72775108F9B6E38181AD312A88991CF5D |
| SHA-512: | F4FA6F5A6659E38761731163C2917BF3B1F06D121EE5E324678C11C8D023DB0FD1DE62932858C3C091BF801A550C28BFB410EDA70769BBD3BFE6663E9D022C8F |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13269 |
| Entropy (8bit): | 0.6229294369515466 |
| Encrypted: | false |
| SSDEEP: | 24:c9lLh9lLh9lIn9lIn9lo6F9loW9lWuAWPLmqptFeifFj:kBqoIBHuAMKqptFeifFj |
| MD5: | A36E3BD3176E8121DAF8BB5140F5CD5B |
| SHA1: | D9C2E1221385DFF800CF7AC01C92B6035A39C0A8 |
| SHA-256: | 5A5217CFCB402B08114E5626D8907C6E824B70AF52052D039DA21FEC0E7F88F7 |
| SHA-512: | DBB2AED59AF662AE1B7806F0C42F3ECC1AA7CC34488C405E957FD4516D9BCF24EECBA097A60EDF93FF6D72AB46AF9E969E92797E1D9BBCEA7A1B678064022E6A |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40097 |
| Entropy (8bit): | 0.6605854536521297 |
| Encrypted: | false |
| SSDEEP: | 96:kBqoxKAuvScS+iEOnURYf9isbM8Yf9isbMTYf9isbM8:kBqoxKAuqR+iEOnURYfNbdYfNbiYfNbP |
| MD5: | AC5213F1863C119F6DC3196DBCE0DCA1 |
| SHA1: | 2D2271EFA95BB84F2D563E7FEBFC833838DA7B5A |
| SHA-256: | 781CE28AABCE64773A6A515B04402D7C45EF6F4848CC9609F05B630728654E0E |
| SHA-512: | A90B9854AD45A914A59A186F9E5F14C83564AA1D97BB293F4BE3112FD7632DD8BC9158F578775FFCEC5F1A7C603DB83AFD1BCACF720D81B2BA4DB67315E136D9 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\internet explorer\iexplore.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40081 |
| Entropy (8bit): | 0.6597380718430703 |
| Encrypted: | false |
| SSDEEP: | 96:kBqoxKAuvScS+j9PGN4quk6qioquk6qiXquk6qiQ:kBqoxKAuqR+j9PGN4qSq9qSqqqSqH |
| MD5: | 04821721DBA30A21E2778D6D8165C437 |
| SHA1: | F18DE01A4E972ABB977A9108572EBB8BBE6E6BBB |
| SHA-256: | 5AC06ED84B93E8CA9B61369AC493D891C7CA33133B6672B2C3892E8259E5E9C8 |
| SHA-512: | 72760C16AFBF3393CBA3D2AAB46CE3D8A2DB2A060B4F5AA5013F2D4AFFED53AA150C36E681B934D0E49AEA123DA61538871D997E3F23872C3C190740042BE00C |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1189 |
| Entropy (8bit): | 5.31795925551072 |
| Encrypted: | false |
| SSDEEP: | 24:BxSAnLxvBn9zx2DOXUWOLCHGIYBtLWfHjeTKKjX4CIym1ZJX/JPOLCHGIYBtcane:BZFvhJoORF/fqDYB1ZDpFyZZa |
| MD5: | 5C19B735B25E4683C49EC53AF83C7ACA |
| SHA1: | 05EF721AC886A6BDC1F239F8D80C419B5F09ECAC |
| SHA-256: | 172C5E835C804347540CC631E478CF6F6BD8F9A5050332C68D897F73D9A00DA1 |
| SHA-512: | 429A69B611E2933CF12DC93468E6BDEA393AB75C6B6B9BA40213BEF539BE25E45233462A76F33804161691939E19E046FFB116208D1502EE6801395D5AC9913E |
| Malicious: | false |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.655383585962167 |
| TrID: |
|
| File name: | onerous.tar.dll |
| File size: | 48128 |
| MD5: | 79d81979dbbd1c8ceb04cc80a903ecd1 |
| SHA1: | f40959018e132fb1430f77a26903af222244676c |
| SHA256: | 5dd2f21b81330a342fe1bb9a17a8fde423928e266d4842887f8b41e5d7c2fbd6 |
| SHA512: | aeede9ecc3cbfef29ad5a1d3d4b66c245ec48e5c7407f81c7997049ce64009d80f7a97b17b8540ac247211478473ed5f1716e555e91eb64bdc94f632e90d15ec |
| SSDEEP: | 768:/JZ7EqWjTpGrg7iSh8NHj4DqVSoqngTeHzD5CHDFuGUJtB:xZ7Eq+T087E4DqVZqngOww7t |
| File Content Preview: | MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L....o._...........!...I..................... ....@.................................j.....@................................ |
File Icon |
|---|
 | |
| Icon Hash: | 74f0e4ecccdce0e4 |
Static PE Info |
|---|
General | |
|---|---|
| Entrypoint: | 0x401000 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED |
| DLL Characteristics: | DYNAMIC_BASE |
| Time Stamp: | 0x5FB76FB9 [Fri Nov 20 07:26:49 2020 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 1 |
| OS Version Minor: | 0 |
| File Version Major: | 1 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 1 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 67fdc237b514ec9fab9c4500917eb60f |
Entrypoint Preview |
|---|
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| cmp dword ptr [ebp+0Ch], 01h |
| jne 00007F5E4CAC4271h |
| call 00007F5E4CAC428Fh |
| leave |
| jmp eax |
| mov eax, 00000001h |
| jmp 00007F5E4CAC427Eh |
| cmp dword ptr [ebp+0Ch], 02h |
| jne 00007F5E4CAC4266h |
| xor eax, eax |
| jmp 00007F5E4CAC4274h |
| cmp dword ptr [ebp+0Ch], 03h |
| jne 00007F5E4CAC4266h |
| xor eax, eax |
| jmp 00007F5E4CAC426Ah |
| cmp dword ptr [ebp+0Ch], 00000000h |
| jne 00007F5E4CAC4264h |
| xor eax, eax |
| leave |
| retn 000Ch |
| push ebx |
| push edi |
| push esi |
| mov ebx, C7618E88h |
| call 00007F5E4CAC4271h |
| add ebx, 04h |
| call 00007F5E4CAC4277h |
| pop esi |
| pop edi |
| pop ebx |
| ret |
| xor eax, eax |
| dec eax |
| sub ebx, eax |
| cmp ebx, 07618E84h |
| jne 00007F5E4CAC4255h |
| ret |
| push 00000040h |
| push 00003000h |
| push 0000B440h |
| push 00000000h |
| call dword ptr [0040D480h] |
| push ebx |
| push 0000B440h |
| push 00402000h |
| push eax |
| call 00007F5E4CAC4266h |
| ret |
| push ebp |
| mov ebp, esp |
| pushad |
| mov edi, dword ptr [ebp+08h] |
| mov esi, dword ptr [ebp+0Ch] |
| mov ecx, dword ptr [ebp+10h] |
| mov edx, dword ptr [ebp+14h] |
| lodsb |
| xor al, dl |
| stosb |
| ror edx, 08h |
| loop 00007F5E4CAC4259h |
| popad |
| leave |
| retn 0010h |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
Data Directories |
|---|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xd440 | 0x58 | .data |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xe000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Sections |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xa3 | 0x200 | False | 0.318359375 | data | 2.32927408159 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
| .data | 0x2000 | 0xb498 | 0xb600 | False | 0.879035027473 | data | 7.7142875486 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .reloc | 0xe000 | 0xc | 0x200 | False | 0.048828125 | data | 0.118369631259 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Imports |
|---|
| DLL | Import |
|---|---|
| KERNEL32.DLL | VirtualAlloc |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 24, 2020 21:19:17.779686928 CET | 49732 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:19:17.779814959 CET | 49733 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:19:18.051623106 CET | 80 | 49732 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:19:18.051764011 CET | 49732 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:19:18.053018093 CET | 49732 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:19:18.056646109 CET | 80 | 49733 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:19:18.056849003 CET | 49733 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:19:18.368787050 CET | 80 | 49732 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:19:19.034208059 CET | 80 | 49732 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:19:19.041465998 CET | 49732 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:19:19.043437004 CET | 49732 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:19:19.316349983 CET | 80 | 49732 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:19:20.001231909 CET | 49733 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:01.623794079 CET | 49750 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:01.624310017 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:01.880029917 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:01.880950928 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:01.881902933 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:01.885428905 CET | 80 | 49750 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:01.885560989 CET | 49750 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.179645061 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.933356047 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.933444023 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.933485985 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.933535099 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.933547020 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.933577061 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.933578968 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.933584929 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.933589935 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.933614016 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.933650970 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.933689117 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.972738981 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.972799063 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.972841024 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.972848892 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.972877979 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.972877979 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:02.972883940 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:02.972922087 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189378977 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189466000 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189506054 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189546108 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189591885 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189603090 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189634085 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189640999 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189646006 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189671040 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189696074 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189708948 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189733028 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189745903 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189752102 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189783096 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189805984 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189821005 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189831972 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189858913 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.189878941 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.189924955 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.228682041 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228734016 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228764057 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228801012 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228838921 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228854895 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.228878021 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228914022 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228918076 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.228943110 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.228959084 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.228991032 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.229039907 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.445724964 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.445785046 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.445826054 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.445866108 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.445905924 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.445954084 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.445981979 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.445997953 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446012974 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446018934 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446022987 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446038008 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446054935 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446078062 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446116924 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446137905 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446146965 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446156979 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446190119 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446197987 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446223021 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446237087 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446258068 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446285963 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446295023 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446329117 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446342945 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446367025 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446382046 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446407080 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446439981 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446466923 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446480989 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446505070 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446521997 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446540117 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.446564913 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.446604013 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582489967 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582540989 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582581997 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582618952 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582667112 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582698107 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582710981 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582730055 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582750082 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582752943 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582787991 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582791090 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582807064 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582832098 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582868099 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582875013 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582907915 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.582921982 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.582958937 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.583004951 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.622404099 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622456074 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622497082 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622608900 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.622638941 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.622643948 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622684002 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622724056 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622747898 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.622765064 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622795105 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.622805119 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.622869968 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.702338934 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.702709913 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.799209118 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799268007 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799299002 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799328089 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799371004 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799411058 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799448013 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799485922 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799526930 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799576044 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799578905 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.799623013 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.799655914 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.799729109 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.838664055 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838721991 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838752985 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838781118 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838820934 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838860035 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838901997 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838942051 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838951111 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.838980913 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.838983059 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.838987112 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.838992119 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.839916945 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:03.878607988 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:03.879178047 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.015002966 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015062094 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015100002 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015136957 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015187025 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015208006 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.015234947 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015240908 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.015275002 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.015279055 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015319109 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015337944 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.015360117 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015398026 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015403032 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.015438080 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.015481949 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.015532970 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.055526972 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.057821989 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.094841957 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.094919920 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.094949961 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.094979048 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.095009089 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.095057011 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.095099926 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.095132113 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.095136881 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.095163107 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.095168114 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.095176935 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.095213890 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.095233917 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.095276117 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.231435061 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231494904 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231523037 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231554031 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231583118 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231623888 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231664896 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231700897 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231739998 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231776953 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231786966 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.231825113 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231834888 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.231867075 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.231898069 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.231956005 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.271276951 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271684885 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271728039 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271764994 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271804094 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271842957 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271878958 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271887064 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.271915913 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.271918058 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.271920919 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.271925926 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.271929979 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.271934032 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.271956921 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.272017002 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.313723087 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.313885927 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.316159964 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.316303968 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.350954056 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.353934050 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447323084 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447377920 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447417021 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447454929 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447493076 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447550058 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447593927 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447594881 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447630882 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447633028 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447640896 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447648048 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447674036 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447700977 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447726965 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447765112 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447789907 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447807074 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.447825909 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.447865963 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.487664938 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.488328934 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.488374949 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.488414049 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.488456011 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.488492966 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.488497972 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.488523960 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.488529921 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.488537073 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.488550901 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.488763094 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.490407944 CET | 49751 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.595921040 CET | 49750 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:04.746153116 CET | 80 | 49751 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:04.901354074 CET | 80 | 49750 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:05.392426014 CET | 80 | 49750 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:05.392524004 CET | 49750 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:05.397114038 CET | 49750 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:05.658798933 CET | 80 | 49750 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:06.224319935 CET | 49752 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:06.224673986 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:06.485444069 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:06.485707998 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:06.486884117 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:06.501492023 CET | 80 | 49752 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:06.501643896 CET | 49752 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:06.790414095 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.513534069 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.513590097 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.513618946 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.513648987 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.513689041 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.513729095 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.513940096 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.514010906 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.552978039 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.553035021 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.553064108 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.553095102 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.553221941 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.558060884 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.774704933 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.774761915 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.774792910 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.774822950 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.774852037 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.774893045 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.774930954 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.774972916 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.775012016 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.775048971 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.775052071 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.775088072 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.775129080 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.775146008 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.775197983 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.775270939 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.813879013 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.813934088 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.813978910 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.814017057 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.814121962 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.814183950 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.818710089 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.818753958 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.818783045 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.818803072 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:07.818913937 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:07.818965912 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.035861015 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.035943031 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.035990000 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036030054 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036068916 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036117077 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036159992 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036197901 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036236048 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036273003 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036309958 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036348104 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036385059 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036432028 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036473989 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036510944 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036549091 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036587954 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036623001 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036655903 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.036966085 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.117624044 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117679119 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117708921 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117738008 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117768049 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117806911 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117846012 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117885113 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117889881 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.117923975 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117940903 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.117948055 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.117964983 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.117966890 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.118000984 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.118009090 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.118024111 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.118084908 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.157073021 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157126904 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157164097 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157202959 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157241106 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157279015 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157291889 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.157316923 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157339096 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.157345057 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.157350063 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.157357931 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.157370090 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.157423973 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.297756910 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.297924042 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319242954 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319287062 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319323063 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319369078 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319400072 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319412947 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319443941 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319451094 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319453001 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319457054 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319462061 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319492102 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319530010 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319530964 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319550991 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319567919 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319602966 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319606066 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319618940 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319644928 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.319667101 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.319705009 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.358778000 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.358833075 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.358871937 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.358908892 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.358948946 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.358961105 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.358987093 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.359009027 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.359015942 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.359019995 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.359024048 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.359028101 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.359036922 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.359081030 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.359097958 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.359119892 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.359137058 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.359175920 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.378710032 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.378813028 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520325899 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520381927 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520422935 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520463943 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520503044 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520509005 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520550966 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520556927 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520562887 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520596027 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520612955 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520636082 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520642042 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520677090 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520692110 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520716906 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520734072 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520756006 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.520771980 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520806074 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.520843983 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.558634043 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.558748960 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580138922 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580179930 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580219984 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580259085 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580287933 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580296993 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580337048 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580337048 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580343962 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580348969 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580353022 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580375910 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580389977 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580424070 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580446005 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580466986 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580471992 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580503941 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.580522060 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.580557108 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721613884 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721677065 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721723080 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721760988 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721795082 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721801996 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721836090 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721843004 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721843958 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721848965 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721853018 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721880913 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721895933 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721920013 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721930027 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.721959114 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.721973896 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.722007036 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.722027063 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.722069979 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761034966 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761091948 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761132956 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761169910 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761200905 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761208057 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761245966 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761251926 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761255026 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761256933 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761261940 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761297941 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761316061 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761337042 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761352062 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761378050 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761398077 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761436939 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761450052 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761487961 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761502981 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761537075 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.761543989 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.761584997 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.781353951 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.781452894 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.922971010 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923026085 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923057079 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923086882 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923129082 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923167944 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923204899 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923254967 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923296928 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923315048 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.923337936 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.923363924 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.923369884 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.923374891 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.923393965 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.962708950 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.962766886 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.962807894 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.962850094 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.962889910 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.962919950 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.962940931 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.962963104 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.962969065 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.962973118 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.962977886 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.962985992 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.963001013 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.963027954 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.963057995 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.963074923 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.963094950 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.963114977 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.963129997 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.963154078 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.963170052 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.963207960 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:08.982688904 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:08.982858896 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.003694057 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.003748894 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.003837109 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.003897905 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.022083998 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.022320032 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124238014 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124291897 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124329090 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124371052 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124396086 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124412060 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124442101 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124447107 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124452114 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124461889 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124506950 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124509096 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124516010 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124545097 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124560118 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124599934 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124733925 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124775887 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.124794006 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.124835014 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.163991928 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164047003 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164089918 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164130926 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164169073 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164197922 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164218903 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164239883 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164246082 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164252043 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164257050 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164266109 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164273977 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164304972 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164320946 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164345026 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164360046 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164385080 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164401054 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164424896 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.164441109 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.164474964 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.183928967 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.184156895 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.205282927 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.205338955 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.205379963 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.205492020 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.205560923 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.205574989 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.223812103 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.223979950 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.326092958 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326159954 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326189995 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326220989 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326261044 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326298952 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326337099 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326385975 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326426983 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326447010 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.326466084 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326484919 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.326494932 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.326508045 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.326570988 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.329256058 CET | 49753 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.379180908 CET | 49752 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:09.590087891 CET | 80 | 49753 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:09.696793079 CET | 80 | 49752 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:10.187980890 CET | 80 | 49752 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:10.188031912 CET | 80 | 49752 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:10.188329935 CET | 49752 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:10.189064026 CET | 49752 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:10.466381073 CET | 80 | 49752 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:10.656172037 CET | 49755 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:10.656227112 CET | 49754 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:10.921529055 CET | 80 | 49755 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:10.921843052 CET | 49755 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:10.923018932 CET | 80 | 49754 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:10.923171043 CET | 49754 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:10.932638884 CET | 49754 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:11.240003109 CET | 80 | 49754 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:11.915036917 CET | 80 | 49754 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:11.915086031 CET | 80 | 49754 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:11.915113926 CET | 80 | 49754 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:11.915154934 CET | 49754 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:11.915214062 CET | 49754 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:11.917689085 CET | 49754 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:12.184501886 CET | 80 | 49754 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:12.933526993 CET | 49755 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:47.278345108 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:47.540668964 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:47.541126966 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:47.541162014 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:47.845313072 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222243071 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222305059 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222347021 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222367048 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.222404003 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222456932 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222493887 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.222507954 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222563028 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222598076 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.222618103 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222668886 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222686052 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.222723961 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.222856998 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.484675884 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.484728098 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.484766960 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.484806061 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.484850883 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.484858036 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.484879017 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.484915972 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.484977007 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.484992027 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.485034943 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485076904 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485116959 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485129118 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.485174894 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485225916 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.485232115 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485282898 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485328913 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485347033 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.485411882 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485443115 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.485483885 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485543013 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485584021 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.485594988 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485644102 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485671997 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.485697985 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.485723972 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.747396946 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747454882 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747494936 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747534990 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747575998 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747591019 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.747610092 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.747638941 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747683048 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747720957 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747742891 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.747782946 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747788906 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.747840881 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747885942 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747936010 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.747940063 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.747997046 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748042107 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748050928 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.748091936 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.748097897 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748150110 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748198032 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748241901 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748251915 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.748297930 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748347998 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.748368025 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.748661995 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850639105 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850658894 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850675106 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850687027 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850698948 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850722075 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850735903 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850750923 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850759029 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850775003 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850791931 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850804090 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850815058 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850828886 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850836039 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850853920 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850867033 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850873947 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850891113 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850899935 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850913048 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850929022 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850939035 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.850949049 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850965977 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850981951 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:48.850990057 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.851015091 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:48.898394108 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.010006905 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.054749012 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.060220003 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060272932 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060312033 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060353041 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060395002 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060436010 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060451984 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.060494900 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060549974 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060556889 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.060610056 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060647011 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060686111 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060714006 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.060739994 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060786009 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060817957 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060827971 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.060877085 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060883045 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.060939074 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.060981035 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.061008930 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.061033964 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.061077118 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.061120987 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.061142921 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.061595917 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.081959963 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.112587929 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.164094925 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.316627026 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316684961 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316724062 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316762924 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316800117 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316847086 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316884041 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.316905975 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316906929 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.316966057 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.316971064 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.317020893 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317060947 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317097902 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317118883 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.317153931 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317194939 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317209959 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.317255020 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317296982 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317323923 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
| Nov 24, 2020 21:20:49.317353964 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.317603111 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.361721992 CET | 49758 | 80 | 192.168.2.3 | 47.241.19.44 |
| Nov 24, 2020 21:20:49.623353004 CET | 80 | 49758 | 47.241.19.44 | 192.168.2.3 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 24, 2020 21:18:57.247888088 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:18:57.283297062 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:18:58.370898962 CET | 60831 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:18:58.406500101 CET | 53 | 60831 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:18:59.613343954 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:18:59.649346113 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:00.950651884 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:00.977987051 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:02.430480003 CET | 50141 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:02.457798958 CET | 53 | 50141 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:03.536190987 CET | 53023 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:03.563496113 CET | 53 | 53023 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:04.573903084 CET | 49563 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:04.600985050 CET | 53 | 49563 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:05.307780981 CET | 51352 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:05.343734026 CET | 53 | 51352 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:06.375205040 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:06.411031008 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:07.416126013 CET | 57084 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:07.443293095 CET | 53 | 57084 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:08.476389885 CET | 58823 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:08.503844976 CET | 53 | 58823 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:10.887249947 CET | 57568 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:10.914577007 CET | 53 | 57568 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:11.981955051 CET | 50540 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:12.018049955 CET | 53 | 50540 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:14.438371897 CET | 54366 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:14.465728045 CET | 53 | 54366 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:15.324086905 CET | 53034 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:15.370722055 CET | 53 | 53034 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:17.721226931 CET | 57762 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:17.724993944 CET | 55435 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:17.759165049 CET | 53 | 57762 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:17.760394096 CET | 53 | 55435 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:23.278008938 CET | 50713 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:23.305476904 CET | 53 | 50713 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:29.867939949 CET | 56132 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:29.907479048 CET | 53 | 56132 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:36.579261065 CET | 58987 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:36.623406887 CET | 53 | 58987 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:45.307039976 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:45.345153093 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:46.300085068 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:46.327358961 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:46.823534012 CET | 60633 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:46.862984896 CET | 53 | 60633 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:47.317177057 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:47.344445944 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:49.214868069 CET | 61292 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:49.242223024 CET | 53 | 61292 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:50.083645105 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:50.111068964 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:53.453824997 CET | 63619 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:53.490825891 CET | 53 | 63619 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:19:54.098855019 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:19:54.134315968 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:20:00.613964081 CET | 64938 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:20:00.653554916 CET | 53 | 64938 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:20:01.575886011 CET | 61946 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:20:01.611551046 CET | 53 | 61946 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:20:06.169200897 CET | 64910 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:20:06.205080986 CET | 53 | 64910 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:20:27.066874981 CET | 52123 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:20:27.093872070 CET | 53 | 52123 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:20:27.429882050 CET | 56130 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:20:27.470750093 CET | 53 | 56130 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:20:47.239192009 CET | 56338 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:20:47.274983883 CET | 53 | 56338 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2020 21:20:47.974076986 CET | 59420 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2020 21:20:48.001683950 CET | 53 | 59420 | 8.8.8.8 | 192.168.2.3 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Nov 24, 2020 21:19:17.724993944 CET | 192.168.2.3 | 8.8.8.8 | 0xeb32 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 24, 2020 21:20:01.575886011 CET | 192.168.2.3 | 8.8.8.8 | 0x3607 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 24, 2020 21:20:06.169200897 CET | 192.168.2.3 | 8.8.8.8 | 0xce1f | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 24, 2020 21:20:47.239192009 CET | 192.168.2.3 | 8.8.8.8 | 0x2611 | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Nov 24, 2020 21:19:17.760394096 CET | 8.8.8.8 | 192.168.2.3 | 0xeb32 | No error (0) | 47.241.19.44 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2020 21:20:01.611551046 CET | 8.8.8.8 | 192.168.2.3 | 0x3607 | No error (0) | 47.241.19.44 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2020 21:20:06.205080986 CET | 8.8.8.8 | 192.168.2.3 | 0xce1f | No error (0) | 47.241.19.44 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2020 21:20:47.274983883 CET | 8.8.8.8 | 192.168.2.3 | 0x2611 | No error (0) | 47.241.19.44 | A (IP address) | IN (0x0001) |
HTTP Request Dependency Graph |
|---|
|
HTTP Packets |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.2.3 | 49732 | 47.241.19.44 | 80 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Nov 24, 2020 21:19:18.053018093 CET | 184 | OUT | |
| Nov 24, 2020 21:19:19.034208059 CET | 197 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 1 | 192.168.2.3 | 49751 | 47.241.19.44 | 80 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Nov 24, 2020 21:20:01.881902933 CET | 4054 | OUT | |
| Nov 24, 2020 21:20:02.933356047 CET | 4055 | IN |