Play interactive tour

Edit tour

Windows Analysis Report PO#578946.exe

Overview

General Information

Sample Name:	PO#578946.exe
Analysis ID:	457760
MD5:	691bde1d30c382256ff1072b8f305841
SHA1:	1ce839f49da7750ab19f0e709747a36dce1933fc
SHA256:	9d1bfddea6c5c0a596af58ed64e6c38d2a274e507ca8d92d8fc801e3d8878cca
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

GuLoader behavior detected

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Disables Windows system restore

Disables the Windows registry editor (regedit)

Disables the Windows task manager (taskmgr)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

May check the online IP address of the machine

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

PO#578946.exe (PID: 3296 cmdline: 'C:\Users\user\Desktop\PO#578946.exe' MD5: 691BDE1D30C382256FF1072B8F305841)

RegAsm.exe (PID: 5296 cmdline: 'C:\Users\user\Desktop\PO#578946.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

RegAsm.exe (PID: 1752 cmdline: 'C:\Users\user\Desktop\PO#578946.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

RegAsm.exe (PID: 3948 cmdline: 'C:\Users\user\Desktop\PO#578946.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

conhost.exe (PID: 3016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 1256 cmdline: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f MD5: CEE2A7E57DF2A159A065A34913A055C2)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

Networking:

Sigma detected: RegAsm connects to smtp port

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 50.116.95.162, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 3948, Protocol: tcp, SourceIp: 192.168.2.3, SourceIsIpv6: false, SourcePort: 49745

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: PO#578946.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: PO#578946.exe	Virustotal: Detection: 57%			Perma Link
Source: PO#578946.exe	ReversingLabs: Detection: 34%

Source: PO#578946.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown

HTTPS traffic detected: 104.21.19.200:443 -> 192.168.2.3:49744 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 142.250.203.110:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49742 version: TLS 1.2

Networking:

May check the online IP address of the machine

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	DNS query: name: checkip.dyndns.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	DNS query: name: checkip.dyndns.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	DNS query: name: checkip.dyndns.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	DNS query: name: checkip.dyndns.org

Source: global traffic

TCP traffic: 192.168.2.3:49745 -> 50.116.95.162:587

Source: Joe Sandbox View

IP Address: 104.21.19.200 104.21.19.200

Source: Joe Sandbox View

ASN Name: OIS1US OIS1US

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

TCP traffic: 192.168.2.3:49745 -> 50.116.95.162:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.19.200:443 -> 192.168.2.3:49744 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adb
Source: RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/1
Source: RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.cobj

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: unknown	HTTPS traffic detected: 142.250.203.110:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49742 version: TLS 1.2

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: PO#578946.exe

Source: C:\Users\user\Desktop\PO#578946.exe	Process Stats: CPU usage > 98%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process Stats: CPU usage > 98%

Source: PO#578946.exe, 00000000.00000000.212800594.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUnderno3.exe vs PO#578946.exe
Source: PO#578946.exe, 00000000.00000002.493967851.0000000002260000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs PO#578946.exe
Source: PO#578946.exe	Binary or memory string: OriginalFilenameUnderno3.exe vs PO#578946.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Source: PO#578946.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@10/1@243/6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\Documents\SnakeKeylogger

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3016:120:WilError_01

Source: C:\Users\user\Desktop\PO#578946.exe

File created: C:\Users\user\AppData\Local\Temp\~DF66F3C3D05512D3AA.TMP

Jump to behavior

Source: PO#578946.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO#578946.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\PO#578946.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: PO#578946.exe	Virustotal: Detection: 57%
Source: PO#578946.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\PO#578946.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_00408EF8 pushad ; ret
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0040953E push eax; iretd
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02292A10 push 32665CA0h; retf 001Dh
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02295BA0 pushfd ; retf

Source: C:\Users\user\Desktop\PO#578946.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 000000000229034B second address: 000000000229034B instructions:
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 0000000002290BBC second address: 0000000002290BEE instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor dword ptr [ebp+68h], 48CC7240h 0x00000011 sub dword ptr [ebp+68h], 525D5669h 0x00000018 xor dword ptr [ebp+68h], 1E5E8B4Ch 0x0000001f add ebx, 04h 0x00000022 mov dword ptr [ebp+00000263h], esi 0x00000028 cmp bh, bh 0x0000002a mov esi, ebx 0x0000002c pushad 0x0000002d mov eax, 0000003Fh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 0000000002291883 second address: 0000000002291883 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\PO#578946.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PO#578946.exe, 00000000.00000002.493995174.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: PO#578946.exe, 00000000.00000002.493995174.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE\SYSWOW64\MSVBVM60.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE\SYSWOW64\MSVBVM60.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE\SYSWOW64\MSVBVM60.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 000000000229034B second address: 000000000229034B instructions:
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 0000000002296191 second address: 0000000002296191 instructions: 0x00000000 rdtsc 0x00000002 mov eax, CFC9D9CCh 0x00000007 xor eax, E7B8D616h 0x0000000c xor eax, B003C39Fh 0x00000011 xor eax, 9872CC44h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F50A0E9671Ah 0x0000001e lfence 0x00000021 mov edx, 324626BAh 0x00000026 xor edx, 8E47B5F1h 0x0000002c xor edx, CD58843Fh 0x00000032 xor edx, 0EA71760h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 cmp cx, dx 0x00000045 add edi, edx 0x00000047 dec ecx 0x00000048 mov dword ptr [ebp+000001B1h], ecx 0x0000004e mov ecx, 1C5A7D24h 0x00000053 xor ecx, 8E853080h 0x00000059 cmp cx, cx 0x0000005c xor ecx, 6F6EDF25h 0x00000062 test ax, dx 0x00000065 sub ecx, FDB19281h 0x0000006b cmp dword ptr [ebp+000001B1h], ecx 0x00000071 mov ecx, dword ptr [ebp+000001B1h] 0x00000077 jne 00007F50A0E966C4h 0x00000079 cmp edx, eax 0x0000007b mov dword ptr [ebp+00000221h], eax 0x00000081 mov eax, ecx 0x00000083 push eax 0x00000084 mov eax, dword ptr [ebp+00000221h] 0x0000008a call 00007F50A0E967E0h 0x0000008f call 00007F50A0E9673Bh 0x00000094 lfence 0x00000097 mov edx, 324626BAh 0x0000009c xor edx, 8E47B5F1h 0x000000a2 xor edx, CD58843Fh 0x000000a8 xor edx, 0EA71760h 0x000000ae mov edx, dword ptr [edx] 0x000000b0 lfence 0x000000b3 ret 0x000000b4 mov esi, edx 0x000000b6 pushad 0x000000b7 rdtsc
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 0000000002296279 second address: 000000000229648C instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007F50A0B55C9Ch 0x00000008 call 00007F50A0B55C11h 0x0000000d lfence 0x00000010 rdtsc
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 000000000229648C second address: 000000000229648C instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, E6128C86h 0x00000013 sub eax, 16292D64h 0x00000018 xor eax, 39A79C13h 0x0000001d xor eax, F64EC330h 0x00000022 jmp 00007F50A0E9676Eh 0x00000024 cmp dh, ch 0x00000026 cpuid 0x00000028 bt ecx, 1Fh 0x0000002c jc 00007F50A0E99A81h 0x00000032 cmp bh, ch 0x00000034 popad 0x00000035 call 00007F50A0E96746h 0x0000003a lfence 0x0000003d rdtsc
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 0000000002290BBC second address: 0000000002290BEE instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor dword ptr [ebp+68h], 48CC7240h 0x00000011 sub dword ptr [ebp+68h], 525D5669h 0x00000018 xor dword ptr [ebp+68h], 1E5E8B4Ch 0x0000001f add ebx, 04h 0x00000022 mov dword ptr [ebp+00000263h], esi 0x00000028 cmp bh, bh 0x0000002a mov esi, ebx 0x0000002c pushad 0x0000002d mov eax, 0000003Fh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 0000000002291883 second address: 0000000002291883 instructions:
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001106191 second address: 0000000001106191 instructions: 0x00000000 rdtsc 0x00000002 mov eax, CFC9D9CCh 0x00000007 xor eax, E7B8D616h 0x0000000c xor eax, B003C39Fh 0x00000011 xor eax, 9872CC44h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F50A0B55B5Ah 0x0000001e lfence 0x00000021 mov edx, 324626BAh 0x00000026 xor edx, 8E47B5F1h 0x0000002c xor edx, CD58843Fh 0x00000032 xor edx, 0EA71760h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 cmp cx, dx 0x00000045 add edi, edx 0x00000047 dec ecx 0x00000048 mov dword ptr [ebp+000001B1h], ecx 0x0000004e mov ecx, 1C5A7D24h 0x00000053 xor ecx, 8E853080h 0x00000059 cmp cx, cx 0x0000005c xor ecx, 6F6EDF25h 0x00000062 test ax, dx 0x00000065 sub ecx, FDB19281h 0x0000006b cmp dword ptr [ebp+000001B1h], ecx 0x00000071 mov ecx, dword ptr [ebp+000001B1h] 0x00000077 jne 00007F50A0B55B04h 0x00000079 cmp edx, eax 0x0000007b mov dword ptr [ebp+00000221h], eax 0x00000081 mov eax, ecx 0x00000083 push eax 0x00000084 mov eax, dword ptr [ebp+00000221h] 0x0000008a call 00007F50A0B55C20h 0x0000008f call 00007F50A0B55B7Bh 0x00000094 lfence 0x00000097 mov edx, 324626BAh 0x0000009c xor edx, 8E47B5F1h 0x000000a2 xor edx, CD58843Fh 0x000000a8 xor edx, 0EA71760h 0x000000ae mov edx, dword ptr [edx] 0x000000b0 lfence 0x000000b3 ret 0x000000b4 mov esi, edx 0x000000b6 pushad 0x000000b7 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001106279 second address: 000000000110648C instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007F50A0E9685Ch 0x00000008 call 00007F50A0E967D1h 0x0000000d lfence 0x00000010 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 000000000110648C second address: 000000000110648C instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, E6128C86h 0x00000013 sub eax, 16292D64h 0x00000018 xor eax, 39A79C13h 0x0000001d xor eax, F64EC330h 0x00000022 jmp 00007F50A0B55BAEh 0x00000024 cmp dh, ch 0x00000026 cpuid 0x00000028 bt ecx, 1Fh 0x0000002c jc 00007F50A0B58EC1h 0x00000032 cmp bh, ch 0x00000034 popad 0x00000035 call 00007F50A0B55B86h 0x0000003a lfence 0x0000003d rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 9023

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99843s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99733s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99624s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99265s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99046s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98827s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98718s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98499s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98390s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98047s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -97937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -97828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99780s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99671s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99562s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -198874s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99327s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99217s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -198218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98983s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98874s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98655s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98546s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98327s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -97999s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -97890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -97781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99655s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -99000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5752	Thread sleep time: -98781s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98827
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98499
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99217
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98781

Source: RegAsm.exe, 00000010.00000003.596866085.000000001EE75000.00000004.00000001.sdmp	Binary or memory string: qSeijyhLAupxJP7GFRtEBI4vMci5Yn8KwAjPFEHs2eL/uAB08c1RHiJzKQFojvE1Po+v
Source: RegAsm.exe, 00000010.00000003.597075106.000000001F234000.00000004.00000001.sdmp	Binary or memory string: z46e9oxTAseWY0w/Ojb81oDo+4/82u8//qclBjLyh3/0nxSbv/ZLvMcIOCdI+0gC05gE
Source: reg.exe, 00000019.00000002.516359726.00000000031D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: PO#578946.exe, 00000000.00000002.493995174.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=windir=\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\syswow64\msvbvm60.dllwindir=\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\syswow64\msvbvm60.dllwindir=\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\syswow64\msvbvm60.dll
Source: reg.exe, 00000019.00000002.516359726.00000000031D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: PO#578946.exe, 00000000.00000002.493995174.00000000022B0000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: RegAsm.exe, 00000010.00000003.596866085.000000001EE75000.00000004.00000001.sdmp	Binary or memory string: V3DpwpQXUCr5++MlWREYz4Pns68z+nyiz1fft58FQn979PlWmvmcIiDUz9VJp4HLtHB8
Source: reg.exe, 00000019.00000002.516359726.00000000031D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: reg.exe, 00000019.00000002.516359726.00000000031D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PO#578946.exe

System information queried: ModuleInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\PO#578946.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1100000

Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'
Source: C:\Users\user\Desktop\PO#578946.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO#578946.exe'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings:

Disables Windows system restore

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore DisableSR

Jump to behavior

Disables the Windows registry editor (regedit)

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools

Jump to behavior

Disables the Windows task manager (taskmgr)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information:

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection111	Masquerading1	OS Credential Dumping2	Security Software Discovery511	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Inhibit System Recovery1
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Modify Registry1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools21	Security Account Manager	Virtualization/Sandbox Evasion231	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion231	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection111	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol23	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	System Network Configuration Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	System Information Discovery214	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO#578946.exe	58%	Virustotal		Browse
PO#578946.exe	35%	ReversingLabs	Win32.Trojan.Fragtor
PO#578946.exe	100%	Avira	HEUR/AGEN.1130122

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ns.adb	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://ns.ado/1	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
rockglen.com	50.116.95.162	true	true	unknown
drive.google.com	142.250.203.110	true	false	high
freegeoip.app	104.21.19.200	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.203.97	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	unknown
doc-04-6s-docs.googleusercontent.com	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	true	unknown
mail.rockglen.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adb	RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c/g	RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.cobj	RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ns.ado/1	RegAsm.exe, 00000010.00000003.554569289.0000000022C51000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.203.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.21.19.200	freegeoip.app	United States	13335	CLOUDFLARENETUS	false
50.116.95.162	rockglen.com	United States	26337	OIS1US	true
142.250.203.110	drive.google.com	United States	15169	GOOGLEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	457760
Start date:	02.08.2021
Start time:	09:35:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 49s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	PO#578946.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Suspected Instruction Hammering Hide Perf
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@10/1@243/6
EGA Information:	Failed
HDC Information:	Successful, ratio: 2.3% (good quality ratio 0.3%) Quality average: 14.3% Quality standard deviation: 30%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, backgroundTaskHost.exe, UsoClient.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, MusNotifyIcon.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.42.151.234, 52.147.198.201, 23.211.4.86, 20.50.102.62, 173.222.108.226, 173.222.108.210, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.82.209.183, 20.54.110.249, 20.190.159.132, 20.190.159.138, 20.190.159.136, 20.190.159.134, 40.126.31.139, 40.126.31.1, 40.126.31.8, 40.126.31.135, 51.104.136.2, 20.49.150.241 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, www.tm.lg.prod.aadmsa.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, settings-win.data.microsoft.com, a767.dscg3.akamai.net, www.tm.a.prd.aadg.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, settingsfd-geo.trafficmanager.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:45:19	API Interceptor	2915x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.21.19.200	JThZQQQwZA.exe	Get hash	malicious	Browse	freegeoip.app/xml/
104.21.19.200	Loader.exe	Get hash	malicious	Browse	freegeoip.app/xml/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
freegeoip.app	IMG-20210802-WA0587-087.exe	Get hash	malicious	Browse	172.67.188.154
	URGENT QUOTATION FROM CHINA SHENHUA_RFQ16602021.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	Anfrage080221.exe	Get hash	malicious	Browse	172.67.188.154
	Quotation.exe	Get hash	malicious	Browse	172.67.188.154
	QT2WO09000008.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	QUOTE 04202021.exe	Get hash	malicious	Browse	104.21.19.200
	REQUEST FOR QUOTATION - PCIHBV2021MRP27220.exe	Get hash	malicious	Browse	172.67.188.154
	REQUEST_.EXE	Get hash	malicious	Browse	104.21.19.200
	Our Company Account Details-08-2021.xlsx	Get hash	malicious	Browse	104.21.19.200
	SHIPPING DOCUMENT & PL.exe	Get hash	malicious	Browse	172.67.188.154
	Referans iin orijinal nakliye belgeleri.pdf.exe	Get hash	malicious	Browse	104.21.19.200
	REVISE INVOICE.exe	Get hash	malicious	Browse	104.21.19.200
	Quotation for C80842178.exe	Get hash	malicious	Browse	104.21.19.200
	order.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	DyxL4y2hv3.exe	Get hash	malicious	Browse	104.21.19.200
	ggx6bFSU05.exe	Get hash	malicious	Browse	172.67.188.154
	SecuriteInfo.com.Trojan.Win32.Save.a.23962.exe	Get hash	malicious	Browse	104.21.19.200
	fBR05jzjti.exe	Get hash	malicious	Browse	172.67.188.154
	Original Shipping .doc	Get hash	malicious	Browse	104.21.19.200
	hfJdO3BjO0.exe	Get hash	malicious	Browse	172.67.188.154

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	IMG-20210802-WA0587-087.exe	Get hash	malicious	Browse	172.67.188.154
	URGENT QUOTATION FROM CHINA SHENHUA_RFQ16602021.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	Anfrage080221.exe	Get hash	malicious	Browse	172.67.188.154
	Quotation.exe	Get hash	malicious	Browse	172.67.188.154
	QT2WO09000008.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	QUOTE 04202021.exe	Get hash	malicious	Browse	104.21.19.200
	85d8c.exe	Get hash	malicious	Browse	104.21.56.66
	85d8c.exe	Get hash	malicious	Browse	172.67.179.203
	REQUEST FOR QUOTATION - PCIHBV2021MRP27220.exe	Get hash	malicious	Browse	172.67.188.154
	ATT96886.HTM	Get hash	malicious	Browse	104.16.18.94
	REQUEST_.EXE	Get hash	malicious	Browse	104.21.19.200
	ATT04604.HTM	Get hash	malicious	Browse	104.16.19.94
	Our Company Account Details-08-2021.xlsx	Get hash	malicious	Browse	104.21.19.200
	Payment For Invoice 321-1005703.exe	Get hash	malicious	Browse	23.227.38.74
	TusisaehJA.exe	Get hash	malicious	Browse	162.159.133.233
	XWXJTOInGn.exe	Get hash	malicious	Browse	162.159.129.233
	NEW PO pdf.exe	Get hash	malicious	Browse	162.159.133.233
	SHIPPING DOCUMENT & PL.exe	Get hash	malicious	Browse	172.67.188.154
	DHL Shipment Notification,PDF.exe	Get hash	malicious	Browse	104.21.28.3
	Referans iin orijinal nakliye belgeleri.pdf.exe	Get hash	malicious	Browse	104.21.19.200
OIS1US	xkNBltP31j.exe	Get hash	malicious	Browse	162.241.2.218
	#Uacac#Uc801 #Ud488#Ubaa9 #Ub9ac#Uc2a4#Ud2b8.exe	Get hash	malicious	Browse	162.241.2.78
	GHAI SHIPMENT SCHEDULE 28TH-07-2021.exe	Get hash	malicious	Browse	162.241.203.110
	AWD SHANGHAI SHIPMENT SCHEDULE.exe	Get hash	malicious	Browse	162.241.203.110
	Order600567.exe	Get hash	malicious	Browse	162.241.2.103
	PYY74882220#.exe	Get hash	malicious	Browse	162.241.203.51
	PI-0387991.exe	Get hash	malicious	Browse	162.241.2.50
	vGXbKUQZZpb0fE8.exe	Get hash	malicious	Browse	162.241.85.193
	K7EnL0C9KJ.exe	Get hash	malicious	Browse	192.185.147.20
	Gift Card 0796907.xlsb	Get hash	malicious	Browse	162.241.3.29
	Gift Card 0796907.xlsb	Get hash	malicious	Browse	162.241.3.29
	Order 9572478.xlsb	Get hash	malicious	Browse	162.241.2.50
	Order 9572478.xlsb	Get hash	malicious	Browse	162.241.2.50
	Order 161488.xlsb	Get hash	malicious	Browse	162.241.3.14
	PO 491196.xlsb	Get hash	malicious	Browse	50.116.94.238
	Order 161488.xlsb	Get hash	malicious	Browse	162.241.3.14
	PO 491196.xlsb	Get hash	malicious	Browse	50.116.94.238
	Order 46975986.xlsb	Get hash	malicious	Browse	162.241.3.29
	WO 2308349.xlsb	Get hash	malicious	Browse	162.241.2.147
	Order 46975986.xlsb	Get hash	malicious	Browse	162.241.3.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	IMG-20210802-WA0587-087.exe	Get hash	malicious	Browse	104.21.19.200
	URGENT QUOTATION FROM CHINA SHENHUA_RFQ16602021.pdf.exe	Get hash	malicious	Browse	104.21.19.200
	Anfrage080221.exe	Get hash	malicious	Browse	104.21.19.200
	Quotation.exe	Get hash	malicious	Browse	104.21.19.200
	QT2WO09000008.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	QUOTE 04202021.exe	Get hash	malicious	Browse	104.21.19.200
	REQUEST FOR QUOTATION - PCIHBV2021MRP27220.exe	Get hash	malicious	Browse	104.21.19.200
	REQUEST_.EXE	Get hash	malicious	Browse	104.21.19.200
	Quotation Request August RFQ8012021.exe	Get hash	malicious	Browse	104.21.19.200
	tsyUOzA9Og.exe	Get hash	malicious	Browse	104.21.19.200
	SHIPPING DOCUMENT & PL.exe	Get hash	malicious	Browse	104.21.19.200
	Referans iin orijinal nakliye belgeleri.pdf.exe	Get hash	malicious	Browse	104.21.19.200
	REVISE INVOICE.exe	Get hash	malicious	Browse	104.21.19.200
	Quotation for C80842178.exe	Get hash	malicious	Browse	104.21.19.200
	order.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	6DSApYckXY.exe	Get hash	malicious	Browse	104.21.19.200
	DyxL4y2hv3.exe	Get hash	malicious	Browse	104.21.19.200
	Booking_confirmation.vbs	Get hash	malicious	Browse	104.21.19.200
	SecuriteInfo.com.Trojan.Win32.Save.a.23962.exe	Get hash	malicious	Browse	104.21.19.200
	fBR05jzjti.exe	Get hash	malicious	Browse	104.21.19.200
37f463bf4616ecd445d4a1937da06e19	Zaobz-rdbmw-xdw-f.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	AR2rPMLtaN.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	NEW PO pdf.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	BFE85B846350851DD4F83DFED498AE60F85D4129329C2.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	Aging invoice.html	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	R5L9IoaG67.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	flJrVwWebP.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	QfVER41Fwx.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	1A263B2603212FF1E492D9E0C718F12601789E27EAABA.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	mbVrdKm3zX.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	bHC6bZhkMz.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	5qW61eKDTp.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	WWzUml7m53.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	e7V79qGVJT.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	it2TiN2UtR.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	4Dm89IWqe9.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	5mr8riiH5q.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	YoKh9rD5xR.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	Oyu6AMjXZH.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97
	IsVEKYHPfW.exe	Get hash	malicious	Browse	142.250.203.110 142.250.203.97

Dropped Files

No context

Created / dropped Files

C:\Users\user\Documents\SnakeKeylogger\Screenshot.png Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	48086893
Entropy (8bit):	7.944436654506759
Encrypted:	false
SSDEEP:	786432:9a7ua7Wa7ua7Ma7Ma7Ma7Ma7Ma7Ma7Ma7Ma7Ma7Ga7Ga7Ga7Ga7Ga7Ga7Ga7Ga7i:9gugWgugMgMgMgMgMgMgMgMgMgGgGgGF
MD5:	B5D3338ED89342F6F4A390B855ACBFAF
SHA1:	597B22F2CA7A5E5958FAE97944141F0EBDFA9526
SHA-256:	FE1C848F0E71BFFC21DDA12869E6A09035B77474BC0F200D18F385D48340C294
SHA-512:	B0B525D4EA3FD2F4F394164B44C359911C4E12D58B00A11F69DEE942277EC3533795E52D53D3C82B6FCB9D57269FBFFB99E867F788F1B3BDFF03B7A75FA189F9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...uEy.}..71.F...._..`b.....&_...^.KD..C.^......&&y..`G..."......=k.....?.f.^{.}.g...]{..}...Y{/,........6\|.Y.......Y.6....M.Z..;7l.....<.?.a.....b6.fL.G.R.;.l.s7".b....6}.Ml....A..~..`......'.......G..c..e.96.r.P.>..s...:...AA=e.@.5......S]$....W....2P.....`.6 ..X\.q..G<v.P~.o3'4.O.G..(........6......_o.';..{..\|Q.tJ..L..V.Z.&....olb...e?,7.F.D{..,nbm...#F6.Nf........P..Z..fq.gG,l.`...j..@..,n..X.4.l.....]b....r..4.Zi.....#K..b\..E.h.$.w>s......x..%./`-...]Dg.r....?...W....G....>..d.lb.#!..< ...6.Dmn..5.....Et.?d...3>...6.D.[.....J.igk`.......@q'.H..:..a.....Nz.uHK8.....#.......z.s...>...p.....LC.....7......2..I.d.o...1...A.M/Z.bL+?./....a..N.h.XZ..@.-.J..3..3....$.u1...#./`-...]Dg.r....?...W....G...^.B}2Uf\....@a;.?d...3>...6.D.[.....J.igk`.......@q'.H..:.J...@...D{.D.Qn.M... A.*m..i, D.....p...]`..G..........@R.dT..9..".N~..52.F....c.r..\|$..)P\|../'u./.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.304822927566701
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO#578946.exe
File size:	98304
MD5:	691bde1d30c382256ff1072b8f305841
SHA1:	1ce839f49da7750ab19f0e709747a36dce1933fc
SHA256:	9d1bfddea6c5c0a596af58ed64e6c38d2a274e507ca8d92d8fc801e3d8878cca
SHA512:	b8eba412543f38959d50279654d72be9f208e45d7fca1023aa07baf75c328d7bf7aba2cbd8a1a9761f6ae1942fcea0f6e593ea1ec2c74d7f941ac734a046ee3c
SSDEEP:	1536:9xnKKKKKKKKKKKKKKKKKKKKKKKKKKKKCKKKKKKKKKKKKKKKKKKKKKKKKKKKKKDKs:oauQiP2d+a
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...[..Z.................P...0...............`....@................

File Icon


Icon Hash:	c4e8c8cccce0e8e8

Static PE Info

General
Entrypoint:	0x4012bc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5A01D35B [Tue Nov 7 15:38:03 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6859d1daf1cf351f8ea3b0beb22606a9

Entrypoint Preview

Instruction
push 00401CB0h
call 00007F50A0B74573h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-72h], ch
sub eax, BF76FBCFh
inc eax
mov al, byte ptr [82068D03h]
jmp 00007F50A0B745EAh
add eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, ah
or dword ptr [ebx+eax], 44h
outsd
outsb
popad
je 00007F50A0B745F1h
jc 00007F50A0B745E7h
outsb
je 00007F50A0B745E3h
outsb
bound esi, dword ptr [ecx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add byte ptr [esi+37h], ah
jle 00007F50A0B74519h
push ds
rcl cl, cl
inc esp
mov eax, 4447D896h
mov cl, 7Eh
jmp 00007F50A0B745B0h
push 0000007Ch
not byte ptr [eax+64h]
or al, 48h
lea eax, dword ptr [ecx+11h]
xor ah, byte ptr [ecx+4Ch]
cmc
cmp cl, byte ptr [bx-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc ecx, dword ptr [ecx]
add byte ptr [eax], al
push cs
or dword ptr [eax], eax
add byte ptr [eax], al
add eax, 62794800h
insb
aaa
add byte ptr [4D000901h], cl
jns 00007F50A0B745F1h
jo 00007F50A0B745E3h
je 00007F50A0B745EAh
jns 00007F50A0B745B7h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x157d4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0xc08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14bfc	0x15000	False	0.442638578869	data	6.71966680684	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0x11b0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0xc08	0x1000	False	0.311279296875	data	3.24284778332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x18360	0x8a8	data
RT_GROUP_ICON	0x1834c	0x14	data
RT_VERSION	0x180f0	0x25c	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaVarForInit, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaFileOpen, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaUI1Str, __vbaCastObj, __vbaStrMove, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0404 0x04b0
InternalName	Underno3
FileVersion	1.00
CompanyName	Collapse Magical
Comments	Collapse Magical
ProductName	dece
ProductVersion	1.00
OriginalFilename	Underno3.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2021 09:45:10.716114998 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.742876053 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:10.743011951 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.775691986 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.801050901 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:10.813112974 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:10.813148975 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:10.813168049 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:10.813184023 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:10.813209057 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.813247919 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.914961100 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.940931082 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:10.941032887 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.961633921 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:10.991825104 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:11.528084993 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:11.528115988 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:11.528130054 CEST	443	49741	142.250.203.110	192.168.2.3
Aug 2, 2021 09:45:11.528240919 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:11.528327942 CEST	49741	443	192.168.2.3	142.250.203.110
Aug 2, 2021 09:45:11.613548040 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.640599966 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.640753984 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.641752005 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.667372942 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.679789066 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.679848909 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.679888964 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.679923058 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.679950953 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.679954052 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.680021048 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.705293894 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.731256962 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:11.731369972 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.732518911 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:11.763247013 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.057761908 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.057804108 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.057826042 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.057847023 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.057869911 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.058048010 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.058077097 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.059453964 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.059489012 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.059837103 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.061033010 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.061216116 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.061482906 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.061665058 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.063240051 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.063276052 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.063421965 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.064538002 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.064569950 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.064781904 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.066296101 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.066332102 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.066571951 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.068085909 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.068367958 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.083152056 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.083187103 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.084429026 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.084527969 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.084567070 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.084820986 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.085786104 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.085820913 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.086076975 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.087455034 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.087492943 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.088167906 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.089231014 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.089266062 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.090300083 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.090991974 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.091025114 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.091417074 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.092988968 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.093028069 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.093504906 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.094562054 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.094595909 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.095105886 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.097363949 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.097393036 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.097852945 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.097877026 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.099576950 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.099615097 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.101558924 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.101593018 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.102014065 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.102041006 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.102044106 CEST	49742	443	192.168.2.3	142.250.203.97
Aug 2, 2021 09:45:12.102747917 CEST	443	49742	142.250.203.97	192.168.2.3
Aug 2, 2021 09:45:12.103138924 CEST	49742	443	192.168.2.3	142.250.203.97

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 2, 2021 09:45:10.640245914 CEST	192.168.2.3	8.8.8.8	0x80ec	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:11.564100981 CEST	192.168.2.3	8.8.8.8	0x9fde	Standard query (0)	doc-04-6s-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.597980022 CEST	192.168.2.3	8.8.8.8	0xe456	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.643327951 CEST	192.168.2.3	8.8.8.8	0xaa84	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:17.139657974 CEST	192.168.2.3	8.8.8.8	0x7c97	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:19.637984037 CEST	192.168.2.3	8.8.8.8	0x127e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:20.323144913 CEST	192.168.2.3	8.8.8.8	0xb09d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:32.048849106 CEST	192.168.2.3	8.8.8.8	0x9623	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:32.509639978 CEST	192.168.2.3	8.8.8.8	0x25ef	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:34.357639074 CEST	192.168.2.3	8.8.8.8	0x5cf3	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:34.672751904 CEST	192.168.2.3	8.8.8.8	0x45f9	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:36.615605116 CEST	192.168.2.3	8.8.8.8	0xcb07	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:36.959482908 CEST	192.168.2.3	8.8.8.8	0xfef9	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:43.884396076 CEST	192.168.2.3	8.8.8.8	0x274c	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:44.496228933 CEST	192.168.2.3	8.8.8.8	0x280f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:46.270169020 CEST	192.168.2.3	8.8.8.8	0x5ee7	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:46.367569923 CEST	192.168.2.3	8.8.8.8	0x6851	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:52.692579985 CEST	192.168.2.3	8.8.8.8	0x53e1	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:52.750407934 CEST	192.168.2.3	8.8.8.8	0xf402	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:54.362121105 CEST	192.168.2.3	8.8.8.8	0xbc4d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:54.468421936 CEST	192.168.2.3	8.8.8.8	0xfedf	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:00.213664055 CEST	192.168.2.3	8.8.8.8	0xab50	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:00.347135067 CEST	192.168.2.3	8.8.8.8	0x2400	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:02.108325958 CEST	192.168.2.3	8.8.8.8	0xec00	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:02.257860899 CEST	192.168.2.3	8.8.8.8	0x7528	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:08.918612957 CEST	192.168.2.3	8.8.8.8	0xe257	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:08.969393969 CEST	192.168.2.3	8.8.8.8	0x973e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:10.599953890 CEST	192.168.2.3	8.8.8.8	0xc3db	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:10.634927988 CEST	192.168.2.3	8.8.8.8	0x72b5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:15.514090061 CEST	192.168.2.3	8.8.8.8	0xe345	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:15.555104017 CEST	192.168.2.3	8.8.8.8	0x44c3	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:18.459589005 CEST	192.168.2.3	8.8.8.8	0x2fa4	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:18.554449081 CEST	192.168.2.3	8.8.8.8	0x6c53	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:23.017002106 CEST	192.168.2.3	8.8.8.8	0xbd2a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:23.060204029 CEST	192.168.2.3	8.8.8.8	0x81e8	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:24.685610056 CEST	192.168.2.3	8.8.8.8	0xe4d8	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:24.718059063 CEST	192.168.2.3	8.8.8.8	0x4846	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:29.056474924 CEST	192.168.2.3	8.8.8.8	0x2d8b	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:29.192763090 CEST	192.168.2.3	8.8.8.8	0x8b30	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:30.817903042 CEST	192.168.2.3	8.8.8.8	0xd20e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:30.897021055 CEST	192.168.2.3	8.8.8.8	0xc0fd	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:35.420763969 CEST	192.168.2.3	8.8.8.8	0x7844	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:35.529314995 CEST	192.168.2.3	8.8.8.8	0xa7fd	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:37.188121080 CEST	192.168.2.3	8.8.8.8	0x4622	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:37.309073925 CEST	192.168.2.3	8.8.8.8	0x796f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:41.945988894 CEST	192.168.2.3	8.8.8.8	0xa1eb	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:41.988800049 CEST	192.168.2.3	8.8.8.8	0x88c5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:43.611129045 CEST	192.168.2.3	8.8.8.8	0xd70f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:43.646833897 CEST	192.168.2.3	8.8.8.8	0xa1d9	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:46.819241047 CEST	192.168.2.3	8.8.8.8	0x181b	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:46.870369911 CEST	192.168.2.3	8.8.8.8	0x6d66	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:49.189351082 CEST	192.168.2.3	8.8.8.8	0x270	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:49.235949993 CEST	192.168.2.3	8.8.8.8	0x522	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:54.219289064 CEST	192.168.2.3	8.8.8.8	0x5bf7	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:54.265743971 CEST	192.168.2.3	8.8.8.8	0x6409	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:55.881211996 CEST	192.168.2.3	8.8.8.8	0x4007	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:55.980108023 CEST	192.168.2.3	8.8.8.8	0x76ef	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:00.384989977 CEST	192.168.2.3	8.8.8.8	0x6252	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:00.475630045 CEST	192.168.2.3	8.8.8.8	0x7f67	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:02.355247974 CEST	192.168.2.3	8.8.8.8	0xf8be	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:02.398333073 CEST	192.168.2.3	8.8.8.8	0xa37e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:08.053877115 CEST	192.168.2.3	8.8.8.8	0x90bf	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:08.138573885 CEST	192.168.2.3	8.8.8.8	0x5bd8	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:09.744910955 CEST	192.168.2.3	8.8.8.8	0x6ed2	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:09.840356112 CEST	192.168.2.3	8.8.8.8	0x5496	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:14.109736919 CEST	192.168.2.3	8.8.8.8	0x1a54	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:14.163242102 CEST	192.168.2.3	8.8.8.8	0xb252	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:15.796964884 CEST	192.168.2.3	8.8.8.8	0x18de	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:15.902574062 CEST	192.168.2.3	8.8.8.8	0xf0c8	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:18.536673069 CEST	192.168.2.3	8.8.8.8	0x9735	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:18.624488115 CEST	192.168.2.3	8.8.8.8	0xd552	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:20.214270115 CEST	192.168.2.3	8.8.8.8	0x424	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:20.312262058 CEST	192.168.2.3	8.8.8.8	0x141d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:23.070590019 CEST	192.168.2.3	8.8.8.8	0x2f66	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:23.116637945 CEST	192.168.2.3	8.8.8.8	0x8a74	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:24.721445084 CEST	192.168.2.3	8.8.8.8	0x6653	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:24.808417082 CEST	192.168.2.3	8.8.8.8	0x448f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:28.925772905 CEST	192.168.2.3	8.8.8.8	0xa8b0	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:28.964011908 CEST	192.168.2.3	8.8.8.8	0x10b2	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:30.612150908 CEST	192.168.2.3	8.8.8.8	0x1496	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:30.652931929 CEST	192.168.2.3	8.8.8.8	0x2d1a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:33.250725031 CEST	192.168.2.3	8.8.8.8	0x88d9	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:33.330559969 CEST	192.168.2.3	8.8.8.8	0x442e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:34.903143883 CEST	192.168.2.3	8.8.8.8	0xf9a7	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:34.950479984 CEST	192.168.2.3	8.8.8.8	0x4005	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:37.646593094 CEST	192.168.2.3	8.8.8.8	0x95f8	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:37.700334072 CEST	192.168.2.3	8.8.8.8	0x2a5f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:39.613461971 CEST	192.168.2.3	8.8.8.8	0x8fa3	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:39.658422947 CEST	192.168.2.3	8.8.8.8	0x35ff	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:43.596174002 CEST	192.168.2.3	8.8.8.8	0xe894	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:43.650342941 CEST	192.168.2.3	8.8.8.8	0x4ada	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:45.482462883 CEST	192.168.2.3	8.8.8.8	0x294d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:45.551743984 CEST	192.168.2.3	8.8.8.8	0x223c	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:48.462874889 CEST	192.168.2.3	8.8.8.8	0x3bcb	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:48.533044100 CEST	192.168.2.3	8.8.8.8	0x9f87	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:50.307912111 CEST	192.168.2.3	8.8.8.8	0x11b6	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:50.358747005 CEST	192.168.2.3	8.8.8.8	0x989f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:54.096009970 CEST	192.168.2.3	8.8.8.8	0x1637	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:54.147169113 CEST	192.168.2.3	8.8.8.8	0x88d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:55.992556095 CEST	192.168.2.3	8.8.8.8	0x8e50	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:56.052067041 CEST	192.168.2.3	8.8.8.8	0x43b3	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:59.556706905 CEST	192.168.2.3	8.8.8.8	0xe208	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:59.595194101 CEST	192.168.2.3	8.8.8.8	0x6adc	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:01.143593073 CEST	192.168.2.3	8.8.8.8	0x1494	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:01.204919100 CEST	192.168.2.3	8.8.8.8	0x83ca	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:05.257616043 CEST	192.168.2.3	8.8.8.8	0xa672	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:05.304929972 CEST	192.168.2.3	8.8.8.8	0xce48	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:07.086226940 CEST	192.168.2.3	8.8.8.8	0xe253	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:07.126219034 CEST	192.168.2.3	8.8.8.8	0x541	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:13.373615980 CEST	192.168.2.3	8.8.8.8	0x862e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:13.439543962 CEST	192.168.2.3	8.8.8.8	0x4297	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:15.288620949 CEST	192.168.2.3	8.8.8.8	0x78ab	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:15.327954054 CEST	192.168.2.3	8.8.8.8	0xaaa5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:19.677969933 CEST	192.168.2.3	8.8.8.8	0x393d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:19.722038031 CEST	192.168.2.3	8.8.8.8	0x8761	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:21.329210997 CEST	192.168.2.3	8.8.8.8	0x439b	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:21.363841057 CEST	192.168.2.3	8.8.8.8	0x9dc0	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:24.191248894 CEST	192.168.2.3	8.8.8.8	0xd25d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:24.230210066 CEST	192.168.2.3	8.8.8.8	0x3da	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:26.437469006 CEST	192.168.2.3	8.8.8.8	0x3c46	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:26.474533081 CEST	192.168.2.3	8.8.8.8	0x98e5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:31.493525982 CEST	192.168.2.3	8.8.8.8	0x7510	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:31.533984900 CEST	192.168.2.3	8.8.8.8	0xf6	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:33.178018093 CEST	192.168.2.3	8.8.8.8	0x1486	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:33.214296103 CEST	192.168.2.3	8.8.8.8	0xc297	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:37.187067986 CEST	192.168.2.3	8.8.8.8	0x7626	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:37.226885080 CEST	192.168.2.3	8.8.8.8	0xa113	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:39.003607988 CEST	192.168.2.3	8.8.8.8	0xf25d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:39.043895006 CEST	192.168.2.3	8.8.8.8	0xa1a9	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:42.078654051 CEST	192.168.2.3	8.8.8.8	0x6a04	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:42.156810999 CEST	192.168.2.3	8.8.8.8	0xb3ca	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:44.001760960 CEST	192.168.2.3	8.8.8.8	0xfc96	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:44.053275108 CEST	192.168.2.3	8.8.8.8	0xb9a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:48.623001099 CEST	192.168.2.3	8.8.8.8	0x69fa	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:48.688002110 CEST	192.168.2.3	8.8.8.8	0x11d5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:50.292376041 CEST	192.168.2.3	8.8.8.8	0x38c0	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:50.324325085 CEST	192.168.2.3	8.8.8.8	0x5a5f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:53.415193081 CEST	192.168.2.3	8.8.8.8	0x9bc1	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:53.467700958 CEST	192.168.2.3	8.8.8.8	0x5607	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:55.081229925 CEST	192.168.2.3	8.8.8.8	0x11	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:55.114909887 CEST	192.168.2.3	8.8.8.8	0x99ac	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:59.318881989 CEST	192.168.2.3	8.8.8.8	0xce5e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:59.362307072 CEST	192.168.2.3	8.8.8.8	0x5552	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:00.973576069 CEST	192.168.2.3	8.8.8.8	0x3261	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:01.025768042 CEST	192.168.2.3	8.8.8.8	0xf1f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:06.290157080 CEST	192.168.2.3	8.8.8.8	0xfacb	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:06.341736078 CEST	192.168.2.3	8.8.8.8	0x8b6d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:07.947299004 CEST	192.168.2.3	8.8.8.8	0x36de	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:07.979257107 CEST	192.168.2.3	8.8.8.8	0xfb16	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:11.445768118 CEST	192.168.2.3	8.8.8.8	0x13da	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:11.488622904 CEST	192.168.2.3	8.8.8.8	0x30d3	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:13.030420065 CEST	192.168.2.3	8.8.8.8	0xe02d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:13.071042061 CEST	192.168.2.3	8.8.8.8	0xc0b0	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:17.438395977 CEST	192.168.2.3	8.8.8.8	0x9cf8	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:17.497136116 CEST	192.168.2.3	8.8.8.8	0x5f82	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:19.212860107 CEST	192.168.2.3	8.8.8.8	0x9e77	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:19.256315947 CEST	192.168.2.3	8.8.8.8	0x8aea	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:22.850569963 CEST	192.168.2.3	8.8.8.8	0xdd54	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:22.907529116 CEST	192.168.2.3	8.8.8.8	0x6f0e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:24.594942093 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:24.631819963 CEST	192.168.2.3	8.8.8.8	0x6e9d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:27.344866991 CEST	192.168.2.3	8.8.8.8	0x6d8e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:27.381747961 CEST	192.168.2.3	8.8.8.8	0xe3db	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:29.231806040 CEST	192.168.2.3	8.8.8.8	0xb885	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:29.277112961 CEST	192.168.2.3	8.8.8.8	0x5e6b	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:32.918514013 CEST	192.168.2.3	8.8.8.8	0x36ee	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:32.964795113 CEST	192.168.2.3	8.8.8.8	0x91ae	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:34.543216944 CEST	192.168.2.3	8.8.8.8	0xf81f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:34.595784903 CEST	192.168.2.3	8.8.8.8	0x5ff2	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:38.784696102 CEST	192.168.2.3	8.8.8.8	0x3f6f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:38.845967054 CEST	192.168.2.3	8.8.8.8	0x5f42	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:40.489392042 CEST	192.168.2.3	8.8.8.8	0x79b3	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:40.538132906 CEST	192.168.2.3	8.8.8.8	0x8e6e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:46.565867901 CEST	192.168.2.3	8.8.8.8	0xc4a4	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:46.607477903 CEST	192.168.2.3	8.8.8.8	0xfabc	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:48.158648968 CEST	192.168.2.3	8.8.8.8	0xec91	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:48.198754072 CEST	192.168.2.3	8.8.8.8	0x838	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:52.416177988 CEST	192.168.2.3	8.8.8.8	0xd50b	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:52.462438107 CEST	192.168.2.3	8.8.8.8	0x740a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:54.028203964 CEST	192.168.2.3	8.8.8.8	0xb069	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:54.068487883 CEST	192.168.2.3	8.8.8.8	0x2bd4	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:56.735129118 CEST	192.168.2.3	8.8.8.8	0x291	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:56.787566900 CEST	192.168.2.3	8.8.8.8	0xd5c7	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:58.397207022 CEST	192.168.2.3	8.8.8.8	0x43a6	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:58.432275057 CEST	192.168.2.3	8.8.8.8	0x7b12	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:02.413136959 CEST	192.168.2.3	8.8.8.8	0xab13	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:02.457256079 CEST	192.168.2.3	8.8.8.8	0x5db1	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:05.235943079 CEST	192.168.2.3	8.8.8.8	0x5250	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:05.270788908 CEST	192.168.2.3	8.8.8.8	0x790e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:09.795066118 CEST	192.168.2.3	8.8.8.8	0x5a91	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:09.855068922 CEST	192.168.2.3	8.8.8.8	0x1ff6	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:11.409172058 CEST	192.168.2.3	8.8.8.8	0x1c3f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:11.458642006 CEST	192.168.2.3	8.8.8.8	0xfae0	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:14.506166935 CEST	192.168.2.3	8.8.8.8	0x45d2	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:14.547188997 CEST	192.168.2.3	8.8.8.8	0x69ab	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:16.227551937 CEST	192.168.2.3	8.8.8.8	0x90dc	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:16.341790915 CEST	192.168.2.3	8.8.8.8	0x399d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:20.418946981 CEST	192.168.2.3	8.8.8.8	0xde9c	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:20.490657091 CEST	192.168.2.3	8.8.8.8	0xf32e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:22.110155106 CEST	192.168.2.3	8.8.8.8	0xbe6a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:22.140851974 CEST	192.168.2.3	8.8.8.8	0x42ee	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:26.349066019 CEST	192.168.2.3	8.8.8.8	0x49a7	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:26.386087894 CEST	192.168.2.3	8.8.8.8	0x87eb	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:27.977926970 CEST	192.168.2.3	8.8.8.8	0xf20a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:28.037537098 CEST	192.168.2.3	8.8.8.8	0x1b9	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:32.442382097 CEST	192.168.2.3	8.8.8.8	0x7c27	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:32.488639116 CEST	192.168.2.3	8.8.8.8	0x21fa	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:35.846986055 CEST	192.168.2.3	8.8.8.8	0x36bf	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:35.955698013 CEST	192.168.2.3	8.8.8.8	0xd788	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:39.246634960 CEST	192.168.2.3	8.8.8.8	0x431a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:39.281991959 CEST	192.168.2.3	8.8.8.8	0xb574	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:40.907927036 CEST	192.168.2.3	8.8.8.8	0x880	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:40.946526051 CEST	192.168.2.3	8.8.8.8	0x12bc	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:45.066673040 CEST	192.168.2.3	8.8.8.8	0xfb6	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:45.100013018 CEST	192.168.2.3	8.8.8.8	0xc4f7	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:46.717093945 CEST	192.168.2.3	8.8.8.8	0x93e5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:46.757356882 CEST	192.168.2.3	8.8.8.8	0xa0e4	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:49.539978027 CEST	192.168.2.3	8.8.8.8	0x6b29	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:49.581866980 CEST	192.168.2.3	8.8.8.8	0xc9df	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:51.413666964 CEST	192.168.2.3	8.8.8.8	0x515	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:51.445415974 CEST	192.168.2.3	8.8.8.8	0xcf88	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:54.076545954 CEST	192.168.2.3	8.8.8.8	0xd933	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:54.135405064 CEST	192.168.2.3	8.8.8.8	0xd312	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:55.752223015 CEST	192.168.2.3	8.8.8.8	0xaceb	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:55.788212061 CEST	192.168.2.3	8.8.8.8	0xef74	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:59.619259119 CEST	192.168.2.3	8.8.8.8	0xd84a	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:59.655174971 CEST	192.168.2.3	8.8.8.8	0x1176	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:01.296392918 CEST	192.168.2.3	8.8.8.8	0x8d0d	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:01.352019072 CEST	192.168.2.3	8.8.8.8	0x6dd4	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:06.689783096 CEST	192.168.2.3	8.8.8.8	0xb2f2	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:06.752317905 CEST	192.168.2.3	8.8.8.8	0xf3d0	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:08.603878021 CEST	192.168.2.3	8.8.8.8	0x975c	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:08.648519993 CEST	192.168.2.3	8.8.8.8	0x7f5c	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:12.000540972 CEST	192.168.2.3	8.8.8.8	0xb55e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:12.033730984 CEST	192.168.2.3	8.8.8.8	0x2283	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:13.631350994 CEST	192.168.2.3	8.8.8.8	0x41e5	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:13.686340094 CEST	192.168.2.3	8.8.8.8	0x877c	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:16.266062975 CEST	192.168.2.3	8.8.8.8	0xe4ec	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:16.302858114 CEST	192.168.2.3	8.8.8.8	0x6b4f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:17.903397083 CEST	192.168.2.3	8.8.8.8	0xc94f	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:17.966917038 CEST	192.168.2.3	8.8.8.8	0x4cb2	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:21.112507105 CEST	192.168.2.3	8.8.8.8	0xcf7e	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:21.167426109 CEST	192.168.2.3	8.8.8.8	0x5f4	Standard query (0)	mail.rockglen.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 2, 2021 09:45:10.675059080 CEST	8.8.8.8	192.168.2.3	0x80ec	No error (0)	drive.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:11.611283064 CEST	8.8.8.8	192.168.2.3	0x9fde	No error (0)	doc-04-6s-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:11.611283064 CEST	8.8.8.8	192.168.2.3	0x9fde	No error (0)	googlehosted.l.googleusercontent.com		142.250.203.97	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.623677969 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:13.623677969 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.623677969 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.623677969 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.623677969 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.623677969 CEST	8.8.8.8	192.168.2.3	0xe456	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.669503927 CEST	8.8.8.8	192.168.2.3	0xaa84	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:13.669503927 CEST	8.8.8.8	192.168.2.3	0xaa84	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.669503927 CEST	8.8.8.8	192.168.2.3	0xaa84	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.669503927 CEST	8.8.8.8	192.168.2.3	0xaa84	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.669503927 CEST	8.8.8.8	192.168.2.3	0xaa84	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:13.669503927 CEST	8.8.8.8	192.168.2.3	0xaa84	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:17.176549911 CEST	8.8.8.8	192.168.2.3	0x7c97	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:17.176549911 CEST	8.8.8.8	192.168.2.3	0x7c97	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:19.802139044 CEST	8.8.8.8	192.168.2.3	0x127e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:19.802139044 CEST	8.8.8.8	192.168.2.3	0x127e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:20.359965086 CEST	8.8.8.8	192.168.2.3	0xb09d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:20.359965086 CEST	8.8.8.8	192.168.2.3	0xb09d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:32.210872889 CEST	8.8.8.8	192.168.2.3	0x9623	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:32.210872889 CEST	8.8.8.8	192.168.2.3	0x9623	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:32.543447971 CEST	8.8.8.8	192.168.2.3	0x25ef	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:32.543447971 CEST	8.8.8.8	192.168.2.3	0x25ef	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:34.390393972 CEST	8.8.8.8	192.168.2.3	0x5cf3	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:34.390393972 CEST	8.8.8.8	192.168.2.3	0x5cf3	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:34.705049038 CEST	8.8.8.8	192.168.2.3	0x45f9	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:34.705049038 CEST	8.8.8.8	192.168.2.3	0x45f9	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:36.650825977 CEST	8.8.8.8	192.168.2.3	0xcb07	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:36.650825977 CEST	8.8.8.8	192.168.2.3	0xcb07	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:36.996237040 CEST	8.8.8.8	192.168.2.3	0xfef9	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:36.996237040 CEST	8.8.8.8	192.168.2.3	0xfef9	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:43.919423103 CEST	8.8.8.8	192.168.2.3	0x274c	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:43.919423103 CEST	8.8.8.8	192.168.2.3	0x274c	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:44.536176920 CEST	8.8.8.8	192.168.2.3	0x280f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:44.536176920 CEST	8.8.8.8	192.168.2.3	0x280f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:46.303602934 CEST	8.8.8.8	192.168.2.3	0x5ee7	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:46.303602934 CEST	8.8.8.8	192.168.2.3	0x5ee7	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:46.400320053 CEST	8.8.8.8	192.168.2.3	0x6851	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:46.400320053 CEST	8.8.8.8	192.168.2.3	0x6851	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:52.726667881 CEST	8.8.8.8	192.168.2.3	0x53e1	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:52.726667881 CEST	8.8.8.8	192.168.2.3	0x53e1	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:52.783135891 CEST	8.8.8.8	192.168.2.3	0xf402	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:52.783135891 CEST	8.8.8.8	192.168.2.3	0xf402	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:54.395288944 CEST	8.8.8.8	192.168.2.3	0xbc4d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:54.395288944 CEST	8.8.8.8	192.168.2.3	0xbc4d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:45:54.506649971 CEST	8.8.8.8	192.168.2.3	0xfedf	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:45:54.506649971 CEST	8.8.8.8	192.168.2.3	0xfedf	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:00.238648891 CEST	8.8.8.8	192.168.2.3	0xab50	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:00.238648891 CEST	8.8.8.8	192.168.2.3	0xab50	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:00.383205891 CEST	8.8.8.8	192.168.2.3	0x2400	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:00.383205891 CEST	8.8.8.8	192.168.2.3	0x2400	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:02.133900881 CEST	8.8.8.8	192.168.2.3	0xec00	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:02.133900881 CEST	8.8.8.8	192.168.2.3	0xec00	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:02.294014931 CEST	8.8.8.8	192.168.2.3	0x7528	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:02.294014931 CEST	8.8.8.8	192.168.2.3	0x7528	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:08.953720093 CEST	8.8.8.8	192.168.2.3	0xe257	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:08.953720093 CEST	8.8.8.8	192.168.2.3	0xe257	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:08.994194031 CEST	8.8.8.8	192.168.2.3	0x973e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:08.994194031 CEST	8.8.8.8	192.168.2.3	0x973e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:10.624488115 CEST	8.8.8.8	192.168.2.3	0xc3db	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:10.624488115 CEST	8.8.8.8	192.168.2.3	0xc3db	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:10.660054922 CEST	8.8.8.8	192.168.2.3	0x72b5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:10.660054922 CEST	8.8.8.8	192.168.2.3	0x72b5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:15.546286106 CEST	8.8.8.8	192.168.2.3	0xe345	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:15.546286106 CEST	8.8.8.8	192.168.2.3	0xe345	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:15.589193106 CEST	8.8.8.8	192.168.2.3	0x44c3	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:15.589193106 CEST	8.8.8.8	192.168.2.3	0x44c3	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:18.487131119 CEST	8.8.8.8	192.168.2.3	0x2fa4	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:18.487131119 CEST	8.8.8.8	192.168.2.3	0x2fa4	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:18.588205099 CEST	8.8.8.8	192.168.2.3	0x6c53	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:18.588205099 CEST	8.8.8.8	192.168.2.3	0x6c53	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:23.045922041 CEST	8.8.8.8	192.168.2.3	0xbd2a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:23.045922041 CEST	8.8.8.8	192.168.2.3	0xbd2a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:23.085026026 CEST	8.8.8.8	192.168.2.3	0x81e8	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:23.085026026 CEST	8.8.8.8	192.168.2.3	0x81e8	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:24.710597992 CEST	8.8.8.8	192.168.2.3	0xe4d8	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:24.710597992 CEST	8.8.8.8	192.168.2.3	0xe4d8	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:24.750432014 CEST	8.8.8.8	192.168.2.3	0x4846	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:24.750432014 CEST	8.8.8.8	192.168.2.3	0x4846	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:29.091962099 CEST	8.8.8.8	192.168.2.3	0x2d8b	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:29.091962099 CEST	8.8.8.8	192.168.2.3	0x2d8b	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:29.225049973 CEST	8.8.8.8	192.168.2.3	0x8b30	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:29.225049973 CEST	8.8.8.8	192.168.2.3	0x8b30	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:30.845866919 CEST	8.8.8.8	192.168.2.3	0xd20e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:30.845866919 CEST	8.8.8.8	192.168.2.3	0xd20e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:30.929594040 CEST	8.8.8.8	192.168.2.3	0xc0fd	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:30.929594040 CEST	8.8.8.8	192.168.2.3	0xc0fd	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:35.453747988 CEST	8.8.8.8	192.168.2.3	0x7844	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:35.453747988 CEST	8.8.8.8	192.168.2.3	0x7844	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:35.557121038 CEST	8.8.8.8	192.168.2.3	0xa7fd	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:35.557121038 CEST	8.8.8.8	192.168.2.3	0xa7fd	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:37.216846943 CEST	8.8.8.8	192.168.2.3	0x4622	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:37.216846943 CEST	8.8.8.8	192.168.2.3	0x4622	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:37.337997913 CEST	8.8.8.8	192.168.2.3	0x796f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:37.337997913 CEST	8.8.8.8	192.168.2.3	0x796f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:41.974180937 CEST	8.8.8.8	192.168.2.3	0xa1eb	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:41.974180937 CEST	8.8.8.8	192.168.2.3	0xa1eb	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:42.013942957 CEST	8.8.8.8	192.168.2.3	0x88c5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:42.013942957 CEST	8.8.8.8	192.168.2.3	0x88c5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:43.636275053 CEST	8.8.8.8	192.168.2.3	0xd70f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:43.636275053 CEST	8.8.8.8	192.168.2.3	0xd70f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:43.672496080 CEST	8.8.8.8	192.168.2.3	0xa1d9	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:43.672496080 CEST	8.8.8.8	192.168.2.3	0xa1d9	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:46.854779959 CEST	8.8.8.8	192.168.2.3	0x181b	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:46.854779959 CEST	8.8.8.8	192.168.2.3	0x181b	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:46.903321028 CEST	8.8.8.8	192.168.2.3	0x6d66	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:46.903321028 CEST	8.8.8.8	192.168.2.3	0x6d66	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:49.226006031 CEST	8.8.8.8	192.168.2.3	0x270	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:49.226006031 CEST	8.8.8.8	192.168.2.3	0x270	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:49.271109104 CEST	8.8.8.8	192.168.2.3	0x522	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:49.271109104 CEST	8.8.8.8	192.168.2.3	0x522	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:54.244044065 CEST	8.8.8.8	192.168.2.3	0x5bf7	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:54.244044065 CEST	8.8.8.8	192.168.2.3	0x5bf7	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:54.293328047 CEST	8.8.8.8	192.168.2.3	0x6409	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:54.293328047 CEST	8.8.8.8	192.168.2.3	0x6409	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:55.915323973 CEST	8.8.8.8	192.168.2.3	0x4007	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:55.915323973 CEST	8.8.8.8	192.168.2.3	0x4007	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:46:56.005091906 CEST	8.8.8.8	192.168.2.3	0x76ef	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:46:56.005091906 CEST	8.8.8.8	192.168.2.3	0x76ef	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:00.411555052 CEST	8.8.8.8	192.168.2.3	0x6252	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:00.411555052 CEST	8.8.8.8	192.168.2.3	0x6252	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:00.501795053 CEST	8.8.8.8	192.168.2.3	0x7f67	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:00.501795053 CEST	8.8.8.8	192.168.2.3	0x7f67	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:02.383023977 CEST	8.8.8.8	192.168.2.3	0xf8be	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:02.383023977 CEST	8.8.8.8	192.168.2.3	0xf8be	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:02.433551073 CEST	8.8.8.8	192.168.2.3	0xa37e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:02.433551073 CEST	8.8.8.8	192.168.2.3	0xa37e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:08.079009056 CEST	8.8.8.8	192.168.2.3	0x90bf	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:08.079009056 CEST	8.8.8.8	192.168.2.3	0x90bf	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:08.166241884 CEST	8.8.8.8	192.168.2.3	0x5bd8	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:08.166241884 CEST	8.8.8.8	192.168.2.3	0x5bd8	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:09.771312952 CEST	8.8.8.8	192.168.2.3	0x6ed2	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:09.771312952 CEST	8.8.8.8	192.168.2.3	0x6ed2	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:09.867958069 CEST	8.8.8.8	192.168.2.3	0x5496	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:09.867958069 CEST	8.8.8.8	192.168.2.3	0x5496	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:14.145710945 CEST	8.8.8.8	192.168.2.3	0x1a54	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:14.145710945 CEST	8.8.8.8	192.168.2.3	0x1a54	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:14.191154957 CEST	8.8.8.8	192.168.2.3	0xb252	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:14.191154957 CEST	8.8.8.8	192.168.2.3	0xb252	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:15.829444885 CEST	8.8.8.8	192.168.2.3	0x18de	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:15.829444885 CEST	8.8.8.8	192.168.2.3	0x18de	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:15.935539007 CEST	8.8.8.8	192.168.2.3	0xf0c8	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:15.935539007 CEST	8.8.8.8	192.168.2.3	0xf0c8	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:18.565794945 CEST	8.8.8.8	192.168.2.3	0x9735	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:18.565794945 CEST	8.8.8.8	192.168.2.3	0x9735	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:18.659775019 CEST	8.8.8.8	192.168.2.3	0xd552	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:18.659775019 CEST	8.8.8.8	192.168.2.3	0xd552	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:20.243352890 CEST	8.8.8.8	192.168.2.3	0x424	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:20.243352890 CEST	8.8.8.8	192.168.2.3	0x424	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:20.339773893 CEST	8.8.8.8	192.168.2.3	0x141d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:20.339773893 CEST	8.8.8.8	192.168.2.3	0x141d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:23.097969055 CEST	8.8.8.8	192.168.2.3	0x2f66	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:23.097969055 CEST	8.8.8.8	192.168.2.3	0x2f66	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:23.153294086 CEST	8.8.8.8	192.168.2.3	0x8a74	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:23.153294086 CEST	8.8.8.8	192.168.2.3	0x8a74	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:24.754427910 CEST	8.8.8.8	192.168.2.3	0x6653	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:24.754427910 CEST	8.8.8.8	192.168.2.3	0x6653	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:24.840810061 CEST	8.8.8.8	192.168.2.3	0x448f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:24.840810061 CEST	8.8.8.8	192.168.2.3	0x448f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:28.951178074 CEST	8.8.8.8	192.168.2.3	0xa8b0	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:28.951178074 CEST	8.8.8.8	192.168.2.3	0xa8b0	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:28.997778893 CEST	8.8.8.8	192.168.2.3	0x10b2	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:28.997778893 CEST	8.8.8.8	192.168.2.3	0x10b2	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:30.637267113 CEST	8.8.8.8	192.168.2.3	0x1496	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:30.637267113 CEST	8.8.8.8	192.168.2.3	0x1496	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:30.677478075 CEST	8.8.8.8	192.168.2.3	0x2d1a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:30.677478075 CEST	8.8.8.8	192.168.2.3	0x2d1a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:33.286360979 CEST	8.8.8.8	192.168.2.3	0x88d9	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:33.286360979 CEST	8.8.8.8	192.168.2.3	0x88d9	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:33.358063936 CEST	8.8.8.8	192.168.2.3	0x442e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:33.358063936 CEST	8.8.8.8	192.168.2.3	0x442e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:34.938680887 CEST	8.8.8.8	192.168.2.3	0xf9a7	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:34.938680887 CEST	8.8.8.8	192.168.2.3	0xf9a7	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:34.978513956 CEST	8.8.8.8	192.168.2.3	0x4005	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:34.978513956 CEST	8.8.8.8	192.168.2.3	0x4005	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:37.674222946 CEST	8.8.8.8	192.168.2.3	0x95f8	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:37.674222946 CEST	8.8.8.8	192.168.2.3	0x95f8	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:37.726599932 CEST	8.8.8.8	192.168.2.3	0x2a5f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:37.726599932 CEST	8.8.8.8	192.168.2.3	0x2a5f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:39.638144016 CEST	8.8.8.8	192.168.2.3	0x8fa3	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:39.638144016 CEST	8.8.8.8	192.168.2.3	0x8fa3	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:39.683432102 CEST	8.8.8.8	192.168.2.3	0x35ff	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:39.683432102 CEST	8.8.8.8	192.168.2.3	0x35ff	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:42.020966053 CEST	8.8.8.8	192.168.2.3	0xe8a9	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:43.632828951 CEST	8.8.8.8	192.168.2.3	0xe894	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:43.632828951 CEST	8.8.8.8	192.168.2.3	0xe894	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:43.684366941 CEST	8.8.8.8	192.168.2.3	0x4ada	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:43.684366941 CEST	8.8.8.8	192.168.2.3	0x4ada	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:45.507745028 CEST	8.8.8.8	192.168.2.3	0x294d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:45.507745028 CEST	8.8.8.8	192.168.2.3	0x294d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:45.576371908 CEST	8.8.8.8	192.168.2.3	0x223c	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:45.576371908 CEST	8.8.8.8	192.168.2.3	0x223c	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:48.489809990 CEST	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:48.489809990 CEST	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:48.561033964 CEST	8.8.8.8	192.168.2.3	0x9f87	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:48.561033964 CEST	8.8.8.8	192.168.2.3	0x9f87	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:50.337532043 CEST	8.8.8.8	192.168.2.3	0x11b6	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:50.337532043 CEST	8.8.8.8	192.168.2.3	0x11b6	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:50.388566017 CEST	8.8.8.8	192.168.2.3	0x989f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:50.388566017 CEST	8.8.8.8	192.168.2.3	0x989f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:54.122206926 CEST	8.8.8.8	192.168.2.3	0x1637	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:54.122206926 CEST	8.8.8.8	192.168.2.3	0x1637	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:54.171746016 CEST	8.8.8.8	192.168.2.3	0x88d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:54.171746016 CEST	8.8.8.8	192.168.2.3	0x88d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:56.028076887 CEST	8.8.8.8	192.168.2.3	0x8e50	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:56.028076887 CEST	8.8.8.8	192.168.2.3	0x8e50	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:56.080285072 CEST	8.8.8.8	192.168.2.3	0x43b3	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:56.080285072 CEST	8.8.8.8	192.168.2.3	0x43b3	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:59.582168102 CEST	8.8.8.8	192.168.2.3	0xe208	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:59.582168102 CEST	8.8.8.8	192.168.2.3	0xe208	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:47:59.626265049 CEST	8.8.8.8	192.168.2.3	0x6adc	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:47:59.626265049 CEST	8.8.8.8	192.168.2.3	0x6adc	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:01.173187971 CEST	8.8.8.8	192.168.2.3	0x1494	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:01.173187971 CEST	8.8.8.8	192.168.2.3	0x1494	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:01.232215881 CEST	8.8.8.8	192.168.2.3	0x83ca	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:01.232215881 CEST	8.8.8.8	192.168.2.3	0x83ca	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:05.285020113 CEST	8.8.8.8	192.168.2.3	0xa672	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:05.285020113 CEST	8.8.8.8	192.168.2.3	0xa672	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:05.332750082 CEST	8.8.8.8	192.168.2.3	0xce48	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:05.332750082 CEST	8.8.8.8	192.168.2.3	0xce48	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:07.112206936 CEST	8.8.8.8	192.168.2.3	0xe253	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:07.112206936 CEST	8.8.8.8	192.168.2.3	0xe253	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:07.286163092 CEST	8.8.8.8	192.168.2.3	0x541	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:07.286163092 CEST	8.8.8.8	192.168.2.3	0x541	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:13.398262978 CEST	8.8.8.8	192.168.2.3	0x862e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:13.398262978 CEST	8.8.8.8	192.168.2.3	0x862e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:13.465425014 CEST	8.8.8.8	192.168.2.3	0x4297	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:13.465425014 CEST	8.8.8.8	192.168.2.3	0x4297	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:15.315458059 CEST	8.8.8.8	192.168.2.3	0x78ab	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:15.315458059 CEST	8.8.8.8	192.168.2.3	0x78ab	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:15.353044033 CEST	8.8.8.8	192.168.2.3	0xaaa5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:15.353044033 CEST	8.8.8.8	192.168.2.3	0xaaa5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:19.704077959 CEST	8.8.8.8	192.168.2.3	0x393d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:19.704077959 CEST	8.8.8.8	192.168.2.3	0x393d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:19.757760048 CEST	8.8.8.8	192.168.2.3	0x8761	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:19.757760048 CEST	8.8.8.8	192.168.2.3	0x8761	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:21.354238033 CEST	8.8.8.8	192.168.2.3	0x439b	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:21.354238033 CEST	8.8.8.8	192.168.2.3	0x439b	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:21.391601086 CEST	8.8.8.8	192.168.2.3	0x9dc0	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:21.391601086 CEST	8.8.8.8	192.168.2.3	0x9dc0	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:24.221292973 CEST	8.8.8.8	192.168.2.3	0xd25d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:24.221292973 CEST	8.8.8.8	192.168.2.3	0xd25d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:24.256548882 CEST	8.8.8.8	192.168.2.3	0x3da	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:24.256548882 CEST	8.8.8.8	192.168.2.3	0x3da	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:26.463398933 CEST	8.8.8.8	192.168.2.3	0x3c46	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:26.463398933 CEST	8.8.8.8	192.168.2.3	0x3c46	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:26.499485016 CEST	8.8.8.8	192.168.2.3	0x98e5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:26.499485016 CEST	8.8.8.8	192.168.2.3	0x98e5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:31.519855022 CEST	8.8.8.8	192.168.2.3	0x7510	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:31.519855022 CEST	8.8.8.8	192.168.2.3	0x7510	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:31.567975998 CEST	8.8.8.8	192.168.2.3	0xf6	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:31.567975998 CEST	8.8.8.8	192.168.2.3	0xf6	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:33.206607103 CEST	8.8.8.8	192.168.2.3	0x1486	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:33.206607103 CEST	8.8.8.8	192.168.2.3	0x1486	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:33.239758015 CEST	8.8.8.8	192.168.2.3	0xc297	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:33.239758015 CEST	8.8.8.8	192.168.2.3	0xc297	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:37.215221882 CEST	8.8.8.8	192.168.2.3	0x7626	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:37.215221882 CEST	8.8.8.8	192.168.2.3	0x7626	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:37.259480000 CEST	8.8.8.8	192.168.2.3	0xa113	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:37.259480000 CEST	8.8.8.8	192.168.2.3	0xa113	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:39.031550884 CEST	8.8.8.8	192.168.2.3	0xf25d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:39.031550884 CEST	8.8.8.8	192.168.2.3	0xf25d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:39.071533918 CEST	8.8.8.8	192.168.2.3	0xa1a9	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:39.071533918 CEST	8.8.8.8	192.168.2.3	0xa1a9	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:42.112571955 CEST	8.8.8.8	192.168.2.3	0x6a04	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:42.112571955 CEST	8.8.8.8	192.168.2.3	0x6a04	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:42.190823078 CEST	8.8.8.8	192.168.2.3	0xb3ca	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:42.190823078 CEST	8.8.8.8	192.168.2.3	0xb3ca	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:44.030039072 CEST	8.8.8.8	192.168.2.3	0xfc96	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:44.030039072 CEST	8.8.8.8	192.168.2.3	0xfc96	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:44.087276936 CEST	8.8.8.8	192.168.2.3	0xb9a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:44.087276936 CEST	8.8.8.8	192.168.2.3	0xb9a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:48.650943041 CEST	8.8.8.8	192.168.2.3	0x69fa	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:48.650943041 CEST	8.8.8.8	192.168.2.3	0x69fa	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:48.715929031 CEST	8.8.8.8	192.168.2.3	0x11d5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:48.715929031 CEST	8.8.8.8	192.168.2.3	0x11d5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:50.317080021 CEST	8.8.8.8	192.168.2.3	0x38c0	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:50.317080021 CEST	8.8.8.8	192.168.2.3	0x38c0	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:50.351003885 CEST	8.8.8.8	192.168.2.3	0x5a5f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:50.351003885 CEST	8.8.8.8	192.168.2.3	0x5a5f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:53.440887928 CEST	8.8.8.8	192.168.2.3	0x9bc1	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:53.440887928 CEST	8.8.8.8	192.168.2.3	0x9bc1	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:53.496656895 CEST	8.8.8.8	192.168.2.3	0x5607	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:53.496656895 CEST	8.8.8.8	192.168.2.3	0x5607	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:55.105834961 CEST	8.8.8.8	192.168.2.3	0x11	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:55.105834961 CEST	8.8.8.8	192.168.2.3	0x11	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:55.140094995 CEST	8.8.8.8	192.168.2.3	0x99ac	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:55.140094995 CEST	8.8.8.8	192.168.2.3	0x99ac	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:59.346158981 CEST	8.8.8.8	192.168.2.3	0xce5e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:59.346158981 CEST	8.8.8.8	192.168.2.3	0xce5e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:48:59.388432026 CEST	8.8.8.8	192.168.2.3	0x5552	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:48:59.388432026 CEST	8.8.8.8	192.168.2.3	0x5552	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:01.000808954 CEST	8.8.8.8	192.168.2.3	0x3261	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:01.000808954 CEST	8.8.8.8	192.168.2.3	0x3261	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:01.054342985 CEST	8.8.8.8	192.168.2.3	0xf1f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:01.054342985 CEST	8.8.8.8	192.168.2.3	0xf1f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:06.318507910 CEST	8.8.8.8	192.168.2.3	0xfacb	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:06.318507910 CEST	8.8.8.8	192.168.2.3	0xfacb	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:06.369237900 CEST	8.8.8.8	192.168.2.3	0x8b6d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:06.369237900 CEST	8.8.8.8	192.168.2.3	0x8b6d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:07.973026037 CEST	8.8.8.8	192.168.2.3	0x36de	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:07.973026037 CEST	8.8.8.8	192.168.2.3	0x36de	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:08.006680965 CEST	8.8.8.8	192.168.2.3	0xfb16	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:08.006680965 CEST	8.8.8.8	192.168.2.3	0xfb16	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:11.475783110 CEST	8.8.8.8	192.168.2.3	0x13da	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:11.475783110 CEST	8.8.8.8	192.168.2.3	0x13da	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:11.517000914 CEST	8.8.8.8	192.168.2.3	0x30d3	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:11.517000914 CEST	8.8.8.8	192.168.2.3	0x30d3	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:13.058198929 CEST	8.8.8.8	192.168.2.3	0xe02d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:13.058198929 CEST	8.8.8.8	192.168.2.3	0xe02d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:13.101252079 CEST	8.8.8.8	192.168.2.3	0xc0b0	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:13.101252079 CEST	8.8.8.8	192.168.2.3	0xc0b0	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:17.463104010 CEST	8.8.8.8	192.168.2.3	0x9cf8	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:17.463104010 CEST	8.8.8.8	192.168.2.3	0x9cf8	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:17.523101091 CEST	8.8.8.8	192.168.2.3	0x5f82	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:17.523101091 CEST	8.8.8.8	192.168.2.3	0x5f82	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:19.245274067 CEST	8.8.8.8	192.168.2.3	0x9e77	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:19.245274067 CEST	8.8.8.8	192.168.2.3	0x9e77	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:19.284338951 CEST	8.8.8.8	192.168.2.3	0x8aea	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:19.284338951 CEST	8.8.8.8	192.168.2.3	0x8aea	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:22.875940084 CEST	8.8.8.8	192.168.2.3	0xdd54	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:22.875940084 CEST	8.8.8.8	192.168.2.3	0xdd54	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:22.934118032 CEST	8.8.8.8	192.168.2.3	0x6f0e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:22.934118032 CEST	8.8.8.8	192.168.2.3	0x6f0e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:24.621123075 CEST	8.8.8.8	192.168.2.3	0x5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:24.621123075 CEST	8.8.8.8	192.168.2.3	0x5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:24.661618948 CEST	8.8.8.8	192.168.2.3	0x6e9d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:24.661618948 CEST	8.8.8.8	192.168.2.3	0x6e9d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:27.374284029 CEST	8.8.8.8	192.168.2.3	0x6d8e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:27.374284029 CEST	8.8.8.8	192.168.2.3	0x6d8e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:27.407407045 CEST	8.8.8.8	192.168.2.3	0xe3db	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:27.407407045 CEST	8.8.8.8	192.168.2.3	0xe3db	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:29.258428097 CEST	8.8.8.8	192.168.2.3	0xb885	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:29.258428097 CEST	8.8.8.8	192.168.2.3	0xb885	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:29.303128004 CEST	8.8.8.8	192.168.2.3	0x5e6b	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:29.303128004 CEST	8.8.8.8	192.168.2.3	0x5e6b	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:32.947340965 CEST	8.8.8.8	192.168.2.3	0x36ee	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:32.947340965 CEST	8.8.8.8	192.168.2.3	0x36ee	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:32.992738008 CEST	8.8.8.8	192.168.2.3	0x91ae	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:32.992738008 CEST	8.8.8.8	192.168.2.3	0x91ae	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:34.568233013 CEST	8.8.8.8	192.168.2.3	0xf81f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:34.568233013 CEST	8.8.8.8	192.168.2.3	0xf81f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:34.623317957 CEST	8.8.8.8	192.168.2.3	0x5ff2	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:34.623317957 CEST	8.8.8.8	192.168.2.3	0x5ff2	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:38.809675932 CEST	8.8.8.8	192.168.2.3	0x3f6f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:38.809675932 CEST	8.8.8.8	192.168.2.3	0x3f6f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:38.874167919 CEST	8.8.8.8	192.168.2.3	0x5f42	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:38.874167919 CEST	8.8.8.8	192.168.2.3	0x5f42	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:40.514384031 CEST	8.8.8.8	192.168.2.3	0x79b3	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:40.514384031 CEST	8.8.8.8	192.168.2.3	0x79b3	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:40.563189030 CEST	8.8.8.8	192.168.2.3	0x8e6e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:40.563189030 CEST	8.8.8.8	192.168.2.3	0x8e6e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:46.590503931 CEST	8.8.8.8	192.168.2.3	0xc4a4	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:46.590503931 CEST	8.8.8.8	192.168.2.3	0xc4a4	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:46.632550001 CEST	8.8.8.8	192.168.2.3	0xfabc	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:46.632550001 CEST	8.8.8.8	192.168.2.3	0xfabc	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:48.184451103 CEST	8.8.8.8	192.168.2.3	0xec91	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:48.184451103 CEST	8.8.8.8	192.168.2.3	0xec91	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:48.223400116 CEST	8.8.8.8	192.168.2.3	0x838	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:48.223400116 CEST	8.8.8.8	192.168.2.3	0x838	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:52.448669910 CEST	8.8.8.8	192.168.2.3	0xd50b	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:52.448669910 CEST	8.8.8.8	192.168.2.3	0xd50b	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:52.487369061 CEST	8.8.8.8	192.168.2.3	0x740a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:52.487369061 CEST	8.8.8.8	192.168.2.3	0x740a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:54.057838917 CEST	8.8.8.8	192.168.2.3	0xb069	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:54.057838917 CEST	8.8.8.8	192.168.2.3	0xb069	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:54.094023943 CEST	8.8.8.8	192.168.2.3	0x2bd4	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:54.094023943 CEST	8.8.8.8	192.168.2.3	0x2bd4	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:56.759948015 CEST	8.8.8.8	192.168.2.3	0x291	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:56.759948015 CEST	8.8.8.8	192.168.2.3	0x291	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:56.817641020 CEST	8.8.8.8	192.168.2.3	0xd5c7	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:56.817641020 CEST	8.8.8.8	192.168.2.3	0xd5c7	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:58.422708988 CEST	8.8.8.8	192.168.2.3	0x43a6	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:58.422708988 CEST	8.8.8.8	192.168.2.3	0x43a6	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:49:58.463932991 CEST	8.8.8.8	192.168.2.3	0x7b12	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:49:58.463932991 CEST	8.8.8.8	192.168.2.3	0x7b12	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:02.439412117 CEST	8.8.8.8	192.168.2.3	0xab13	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:02.439412117 CEST	8.8.8.8	192.168.2.3	0xab13	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:02.482144117 CEST	8.8.8.8	192.168.2.3	0x5db1	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:02.482144117 CEST	8.8.8.8	192.168.2.3	0x5db1	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:05.263669968 CEST	8.8.8.8	192.168.2.3	0x5250	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:05.263669968 CEST	8.8.8.8	192.168.2.3	0x5250	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:05.298639059 CEST	8.8.8.8	192.168.2.3	0x790e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:05.298639059 CEST	8.8.8.8	192.168.2.3	0x790e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:09.821121931 CEST	8.8.8.8	192.168.2.3	0x5a91	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:09.821121931 CEST	8.8.8.8	192.168.2.3	0x5a91	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:09.881120920 CEST	8.8.8.8	192.168.2.3	0x1ff6	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:09.881120920 CEST	8.8.8.8	192.168.2.3	0x1ff6	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:11.435391903 CEST	8.8.8.8	192.168.2.3	0x1c3f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:11.435391903 CEST	8.8.8.8	192.168.2.3	0x1c3f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:11.484046936 CEST	8.8.8.8	192.168.2.3	0xfae0	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:11.484046936 CEST	8.8.8.8	192.168.2.3	0xfae0	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:14.530935049 CEST	8.8.8.8	192.168.2.3	0x45d2	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:14.530935049 CEST	8.8.8.8	192.168.2.3	0x45d2	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:14.571953058 CEST	8.8.8.8	192.168.2.3	0x69ab	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:14.571953058 CEST	8.8.8.8	192.168.2.3	0x69ab	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:16.260355949 CEST	8.8.8.8	192.168.2.3	0x90dc	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:16.260355949 CEST	8.8.8.8	192.168.2.3	0x90dc	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:16.369369030 CEST	8.8.8.8	192.168.2.3	0x399d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:16.369369030 CEST	8.8.8.8	192.168.2.3	0x399d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:20.446760893 CEST	8.8.8.8	192.168.2.3	0xde9c	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:20.446760893 CEST	8.8.8.8	192.168.2.3	0xde9c	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:20.515379906 CEST	8.8.8.8	192.168.2.3	0xf32e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:20.515379906 CEST	8.8.8.8	192.168.2.3	0xf32e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:22.135353088 CEST	8.8.8.8	192.168.2.3	0xbe6a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:22.135353088 CEST	8.8.8.8	192.168.2.3	0xbe6a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:22.165380955 CEST	8.8.8.8	192.168.2.3	0x42ee	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:22.165380955 CEST	8.8.8.8	192.168.2.3	0x42ee	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:26.376738071 CEST	8.8.8.8	192.168.2.3	0x49a7	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:26.376738071 CEST	8.8.8.8	192.168.2.3	0x49a7	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:26.411938906 CEST	8.8.8.8	192.168.2.3	0x87eb	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:26.411938906 CEST	8.8.8.8	192.168.2.3	0x87eb	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:28.003098965 CEST	8.8.8.8	192.168.2.3	0xf20a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:28.003098965 CEST	8.8.8.8	192.168.2.3	0xf20a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:28.065094948 CEST	8.8.8.8	192.168.2.3	0x1b9	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:28.065094948 CEST	8.8.8.8	192.168.2.3	0x1b9	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:32.468842030 CEST	8.8.8.8	192.168.2.3	0x7c27	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:32.468842030 CEST	8.8.8.8	192.168.2.3	0x7c27	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:32.517771006 CEST	8.8.8.8	192.168.2.3	0x21fa	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:32.517771006 CEST	8.8.8.8	192.168.2.3	0x21fa	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:35.883368015 CEST	8.8.8.8	192.168.2.3	0x36bf	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:35.883368015 CEST	8.8.8.8	192.168.2.3	0x36bf	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:35.981316090 CEST	8.8.8.8	192.168.2.3	0xd788	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:35.981316090 CEST	8.8.8.8	192.168.2.3	0xd788	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:39.271228075 CEST	8.8.8.8	192.168.2.3	0x431a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:39.271228075 CEST	8.8.8.8	192.168.2.3	0x431a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:39.310633898 CEST	8.8.8.8	192.168.2.3	0xb574	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:39.310633898 CEST	8.8.8.8	192.168.2.3	0xb574	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:40.932914972 CEST	8.8.8.8	192.168.2.3	0x880	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:40.932914972 CEST	8.8.8.8	192.168.2.3	0x880	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:40.978878975 CEST	8.8.8.8	192.168.2.3	0x12bc	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:40.978878975 CEST	8.8.8.8	192.168.2.3	0x12bc	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:45.091705084 CEST	8.8.8.8	192.168.2.3	0xfb6	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:45.091705084 CEST	8.8.8.8	192.168.2.3	0xfb6	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:45.124627113 CEST	8.8.8.8	192.168.2.3	0xc4f7	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:45.124627113 CEST	8.8.8.8	192.168.2.3	0xc4f7	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:46.741981983 CEST	8.8.8.8	192.168.2.3	0x93e5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:46.741981983 CEST	8.8.8.8	192.168.2.3	0x93e5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:46.786699057 CEST	8.8.8.8	192.168.2.3	0xa0e4	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:46.786699057 CEST	8.8.8.8	192.168.2.3	0xa0e4	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:49.564523935 CEST	8.8.8.8	192.168.2.3	0x6b29	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:49.564523935 CEST	8.8.8.8	192.168.2.3	0x6b29	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:49.606739044 CEST	8.8.8.8	192.168.2.3	0xc9df	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:49.606739044 CEST	8.8.8.8	192.168.2.3	0xc9df	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:51.438769102 CEST	8.8.8.8	192.168.2.3	0x515	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:51.438769102 CEST	8.8.8.8	192.168.2.3	0x515	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:51.471240997 CEST	8.8.8.8	192.168.2.3	0xcf88	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:51.471240997 CEST	8.8.8.8	192.168.2.3	0xcf88	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:54.104126930 CEST	8.8.8.8	192.168.2.3	0xd933	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:54.104126930 CEST	8.8.8.8	192.168.2.3	0xd933	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:54.161185980 CEST	8.8.8.8	192.168.2.3	0xd312	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:54.161185980 CEST	8.8.8.8	192.168.2.3	0xd312	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:55.777972937 CEST	8.8.8.8	192.168.2.3	0xaceb	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:55.777972937 CEST	8.8.8.8	192.168.2.3	0xaceb	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:55.815747976 CEST	8.8.8.8	192.168.2.3	0xef74	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:55.815747976 CEST	8.8.8.8	192.168.2.3	0xef74	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:59.648690939 CEST	8.8.8.8	192.168.2.3	0xd84a	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:59.648690939 CEST	8.8.8.8	192.168.2.3	0xd84a	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:50:59.682889938 CEST	8.8.8.8	192.168.2.3	0x1176	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:50:59.682889938 CEST	8.8.8.8	192.168.2.3	0x1176	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:01.321376085 CEST	8.8.8.8	192.168.2.3	0x8d0d	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:01.321376085 CEST	8.8.8.8	192.168.2.3	0x8d0d	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:01.379951000 CEST	8.8.8.8	192.168.2.3	0x6dd4	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:01.379951000 CEST	8.8.8.8	192.168.2.3	0x6dd4	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:06.716548920 CEST	8.8.8.8	192.168.2.3	0xb2f2	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:06.716548920 CEST	8.8.8.8	192.168.2.3	0xb2f2	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:06.778675079 CEST	8.8.8.8	192.168.2.3	0xf3d0	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:06.778675079 CEST	8.8.8.8	192.168.2.3	0xf3d0	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:08.631591082 CEST	8.8.8.8	192.168.2.3	0x975c	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:08.631591082 CEST	8.8.8.8	192.168.2.3	0x975c	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:08.674249887 CEST	8.8.8.8	192.168.2.3	0x7f5c	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:08.674249887 CEST	8.8.8.8	192.168.2.3	0x7f5c	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:12.025502920 CEST	8.8.8.8	192.168.2.3	0xb55e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:12.025502920 CEST	8.8.8.8	192.168.2.3	0xb55e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:12.067959070 CEST	8.8.8.8	192.168.2.3	0x2283	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:12.067959070 CEST	8.8.8.8	192.168.2.3	0x2283	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:13.658449888 CEST	8.8.8.8	192.168.2.3	0x41e5	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:13.658449888 CEST	8.8.8.8	192.168.2.3	0x41e5	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:13.711007118 CEST	8.8.8.8	192.168.2.3	0x877c	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:13.711007118 CEST	8.8.8.8	192.168.2.3	0x877c	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:16.293859005 CEST	8.8.8.8	192.168.2.3	0xe4ec	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:16.293859005 CEST	8.8.8.8	192.168.2.3	0xe4ec	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:16.339611053 CEST	8.8.8.8	192.168.2.3	0x6b4f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:16.339611053 CEST	8.8.8.8	192.168.2.3	0x6b4f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:17.940845013 CEST	8.8.8.8	192.168.2.3	0xc94f	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:17.940845013 CEST	8.8.8.8	192.168.2.3	0xc94f	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:17.994832039 CEST	8.8.8.8	192.168.2.3	0x4cb2	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:17.994832039 CEST	8.8.8.8	192.168.2.3	0x4cb2	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:21.137686968 CEST	8.8.8.8	192.168.2.3	0xcf7e	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:21.137686968 CEST	8.8.8.8	192.168.2.3	0xcf7e	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)
Aug 2, 2021 09:51:21.192719936 CEST	8.8.8.8	192.168.2.3	0x5f4	No error (0)	mail.rockglen.com	rockglen.com		CNAME (Canonical name)	IN (0x0001)
Aug 2, 2021 09:51:21.192719936 CEST	8.8.8.8	192.168.2.3	0x5f4	No error (0)	rockglen.com		50.116.95.162	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

checkip.dyndns.org

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: PO#578946.exe PID: 3296 Parent PID: 5672

General

Start time:	09:42:55
Start date:	02/08/2021
Path:	C:\Users\user\Desktop\PO#578946.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO#578946.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	691BDE1D30C382256FF1072B8F305841
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Analysis Process: RegAsm.exe PID: 5296 Parent PID: 3296

General

Start time:	09:44:00
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\PO#578946.exe'
Imagebase:	0x510000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: RegAsm.exe PID: 1752 Parent PID: 3296

General

Start time:	09:44:01
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\PO#578946.exe'
Imagebase:	0x1c0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: RegAsm.exe PID: 3948 Parent PID: 3296

General

Start time:	09:44:01
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO#578946.exe'
Imagebase:	0xce0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: conhost.exe PID: 3016 Parent PID: 3948

General

Start time:	09:44:01
Start date:	02/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: reg.exe PID: 1256 Parent PID: 3948

General

Start time:	09:45:17
Start date:	02/08/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Imagebase:	0x7ff7488e0000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact .
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Services, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PO#578946.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Networking:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Code Manipulations

Statistics

Behavior

System Behavior