Edit tour

Windows Analysis Report
9gkAKTWOXp.exe

Overview

General Information

Sample Name:	9gkAKTWOXp.exe
Analysis ID:	694569
MD5:	74e135b472b7496b371ce3ba3acfeea8
SHA1:	b64fdd870ff28291b8347317a838a5fb210a6056
SHA256:	d093322a612760cb00ae6fb4c453851ba26f59f2e6a0920b5871a28bbddf9355
Tags:	exe
Infos:

Detection

Gandcrab

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Gandcrab

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Contains functionality to determine the online IP of the system

Found Tor onion address

Uses nslookup.exe to query domains

Machine Learning detection for sample

May check the online IP address of the machine

Machine Learning detection for dropped file

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Too many similar processes found

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Queries information about the installed CPU (vendor, model number etc)

Drops PE files

Found evaded block containing many API calls

Contains functionality to enumerate device drivers

Checks for available system drives (often done to infect USB drives)

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

9gkAKTWOXp.exe (PID: 4664 cmdline: "C:\Users\user\Desktop\9gkAKTWOXp.exe" MD5: 74E135B472B7496B371CE3BA3ACFEEA8)

nslookup.exe (PID: 5752 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 484 cmdline: nslookup emsisoft.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 1944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 5368 cmdline: nslookup gandcrab.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 4184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 6080 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 3232 cmdline: nslookup emsisoft.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 3460 cmdline: nslookup gandcrab.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 3880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 408 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 996 cmdline: nslookup emsisoft.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 5780 cmdline: nslookup gandcrab.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 5880 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 4272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 4948 cmdline: nslookup emsisoft.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 1328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 6064 cmdline: nslookup gandcrab.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 1976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 5784 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 2516 cmdline: nslookup emsisoft.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 3184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 576 cmdline: nslookup gandcrab.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 5964 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 4512 cmdline: nslookup emsisoft.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 1360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 1556 cmdline: nslookup gandcrab.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 2140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 2764 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 4820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 4272 cmdline: nslookup emsisoft.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 3184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 5236 cmdline: nslookup gandcrab.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nslookup.exe (PID: 5708 cmdline: nslookup nomoreransom.bit dns1.soprodns.ru MD5: 8E82529D1475D67615ADCB4E1B8F4EEC)

conhost.exe (PID: 3196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vkspii.exe (PID: 6028 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe" MD5: 551DA842D854798E9D42602EB420BD96)

vkspii.exe (PID: 4024 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe" MD5: 551DA842D854798E9D42602EB420BD96)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
9gkAKTWOXp.exe	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
9gkAKTWOXp.exe	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
9gkAKTWOXp.exe	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.295326787.000000000040E000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000015.00000002.305269157.000000000040E000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
Process Memory Space: 9gkAKTWOXp.exe PID: 4664	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
Process Memory Space: vkspii.exe PID: 6028	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
Process Memory Space: vkspii.exe PID: 4024	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.0.vkspii.exe.400000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
13.0.vkspii.exe.400000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
13.0.vkspii.exe.400000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.2.9gkAKTWOXp.exe.400000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
1.2.9gkAKTWOXp.exe.400000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
1.2.9gkAKTWOXp.exe.400000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
13.2.vkspii.exe.400000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
13.2.vkspii.exe.400000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
13.2.vkspii.exe.400000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
21.2.vkspii.exe.400000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
21.2.vkspii.exe.400000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
1.0.9gkAKTWOXp.exe.400000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
21.2.vkspii.exe.400000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.0.9gkAKTWOXp.exe.400000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
1.0.9gkAKTWOXp.exe.400000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
21.0.vkspii.exe.400000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf716:$: DECRYPT.txt 0xf784:$: DECRYPT.txt
21.0.vkspii.exe.400000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
21.0.vkspii.exe.400000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf70c:$string1: GDCB-DECRYPT.txt 0xf77a:$string1: GDCB-DECRYPT.txt 0xf460:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
Click to see the 13 entries

Snort Signatures

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855642532829498 09/01/22-00:01:41.321667
SID:	2829498
Source Port:	55642
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860090532829500 09/01/22-00:02:16.489371
SID:	2829500
Source Port:	60090
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862436532026737 09/01/22-00:02:57.542714
SID:	2026737
Source Port:	62436
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855955532829500 09/01/22-00:03:25.632008
SID:	2829500
Source Port:	55955
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853431532829498 09/01/22-00:02:18.409896
SID:	2829498
Source Port:	53431
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865513532829500 09/01/22-00:02:19.430995
SID:	2829500
Source Port:	65513
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864276532829498 09/01/22-00:03:00.100399
SID:	2829498
Source Port:	64276
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851891532026737 09/01/22-00:03:31.975246
SID:	2026737
Source Port:	51891
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859765532026737 09/01/22-00:03:34.032990
SID:	2026737
Source Port:	59765
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853309532829500 09/01/22-00:01:54.918396
SID:	2829500
Source Port:	53309
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854155532829498 09/01/22-00:02:39.711366
SID:	2829498
Source Port:	54155
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849169532829500 09/01/22-00:02:32.443414
SID:	2829500
Source Port:	49169
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864378532829500 09/01/22-00:03:19.972139
SID:	2829500
Source Port:	64378
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857391532829500 09/01/22-00:02:53.276938
SID:	2829500
Source Port:	57391
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851597532026737 09/01/22-00:03:26.976848
SID:	2026737
Source Port:	51597
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853271532829498 09/01/22-00:02:55.260307
SID:	2829498
Source Port:	53271
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853471532829500 09/01/22-00:02:00.665796
SID:	2829500
Source Port:	53471
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865323532026737 09/01/22-00:01:43.859132
SID:	2026737
Source Port:	65323
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860647532829498 09/01/22-00:03:25.300157
SID:	2829498
Source Port:	60647
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850230532026737 09/01/22-00:02:54.735839
SID:	2026737
Source Port:	50230
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850624532026737 09/01/22-00:03:18.677171
SID:	2026737
Source Port:	50624
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853468532829500 09/01/22-00:02:00.604247
SID:	2829500
Source Port:	53468
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858122532829498 09/01/22-00:02:27.905128
SID:	2829498
Source Port:	58122
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854436532829498 09/01/22-00:03:36.045306
SID:	2829498
Source Port:	54436
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862426532026737 09/01/22-00:03:13.145963
SID:	2026737
Source Port:	62426
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856046532829500 09/01/22-00:01:38.500367
SID:	2829500
Source Port:	56046
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859378532829500 09/01/22-00:02:48.340518
SID:	2829500
Source Port:	59378
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858305532026737 09/01/22-00:02:34.497221
SID:	2026737
Source Port:	58305
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861418532829498 09/01/22-00:02:02.984507
SID:	2829498
Source Port:	61418
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850095532026737 09/01/22-00:03:38.741458
SID:	2026737
Source Port:	50095
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852114532026737 09/01/22-00:03:20.324395
SID:	2026737
Source Port:	52114
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865466532829500 09/01/22-00:03:37.373699
SID:	2829500
Source Port:	65466
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853042532026737 09/01/22-00:03:06.339869
SID:	2026737
Source Port:	53042
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849877532829500 09/01/22-00:02:36.035379
SID:	2829500
Source Port:	49877
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864971532829500 09/01/22-00:03:05.617213
SID:	2829500
Source Port:	64971
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861186532829498 09/01/22-00:02:52.648140
SID:	2829498
Source Port:	61186
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859829532829500 09/01/22-00:02:55.953112
SID:	2829500
Source Port:	59829
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849204532026737 09/01/22-00:02:46.678054
SID:	2026737
Source Port:	49204
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861364532829498 09/01/22-00:03:28.558638
SID:	2829498
Source Port:	61364
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857829532829500 09/01/22-00:03:23.021549
SID:	2829500
Source Port:	57829
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850788532026737 09/01/22-00:02:43.387386
SID:	2026737
Source Port:	50788
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851996532026737 09/01/22-00:02:26.312895
SID:	2026737
Source Port:	51996
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857706532829500 09/01/22-00:01:42.686131
SID:	2829500
Source Port:	57706
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859436532026737 09/01/22-00:01:57.638087
SID:	2026737
Source Port:	59436
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859822532026737 09/01/22-00:02:19.952319
SID:	2026737
Source Port:	59822
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860587532026737 09/01/22-00:01:27.550732
SID:	2026737
Source Port:	60587
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852957532829500 09/01/22-00:01:25.328522
SID:	2829500
Source Port:	52957
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858914532829500 09/01/22-00:03:18.020601
SID:	2829500
Source Port:	58914
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853850532026737 09/01/22-00:01:50.247028
SID:	2026737
Source Port:	53850
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856619532026737 09/01/22-00:02:49.126045
SID:	2026737
Source Port:	56619
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852112532026737 09/01/22-00:03:20.284135
SID:	2026737
Source Port:	52112
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865198532829500 09/01/22-00:02:04.768621
SID:	2829500
Source Port:	65198
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853848532829498 09/01/22-00:01:59.462827
SID:	2829498
Source Port:	53848
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851893532026737 09/01/22-00:03:32.036713
SID:	2026737
Source Port:	51893
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854433532829498 09/01/22-00:03:35.979601
SID:	2829498
Source Port:	54433
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853310532829500 09/01/22-00:01:54.940366
SID:	2829500
Source Port:	53310
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859438532026737 09/01/22-00:01:57.681285
SID:	2026737
Source Port:	59438
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861421532829498 09/01/22-00:02:03.043258
SID:	2829498
Source Port:	61421
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852458532026737 09/01/22-00:03:02.844406
SID:	2026737
Source Port:	52458
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855652532829498 09/01/22-00:03:19.259211
SID:	2829498
Source Port:	55652
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861130532829498 09/01/22-00:03:15.942186
SID:	2829498
Source Port:	61130
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860421532829498 09/01/22-00:03:32.382333
SID:	2829498
Source Port:	60421
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864973532829500 09/01/22-00:03:05.661525
SID:	2829500
Source Port:	64973
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863567532026737 09/01/22-00:02:17.089606
SID:	2026737
Source Port:	63567
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865463532829500 09/01/22-00:03:37.309587
SID:	2829500
Source Port:	65463
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865389532026737 09/01/22-00:02:38.719558
SID:	2026737
Source Port:	65389
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853040532026737 09/01/22-00:03:06.300781
SID:	2026737
Source Port:	53040
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857827532829500 09/01/22-00:03:22.978908
SID:	2829500
Source Port:	57827
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853039532026737 09/01/22-00:03:06.280270
SID:	2026737
Source Port:	53039
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859585532026737 09/01/22-00:02:11.746820
SID:	2026737
Source Port:	59585
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857708532829500 09/01/22-00:01:42.729663
SID:	2829500
Source Port:	57708
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851142532829498 09/01/22-00:01:24.090037
SID:	2829498
Source Port:	51142
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853433532829498 09/01/22-00:02:18.458138
SID:	2829498
Source Port:	53433
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860093532829500 09/01/22-00:02:16.558554
SID:	2829500
Source Port:	60093
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849206532026737 09/01/22-00:02:46.717208
SID:	2026737
Source Port:	49206
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851143532829498 09/01/22-00:01:24.124615
SID:	2829498
Source Port:	51143
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854158532829498 09/01/22-00:02:39.772185
SID:	2829498
Source Port:	54158
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859376532829500 09/01/22-00:02:48.263272
SID:	2829500
Source Port:	59376
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864825532829500 09/01/22-00:02:24.749273
SID:	2829500
Source Port:	64825
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864273532829498 09/01/22-00:03:00.036817
SID:	2829498
Source Port:	64273
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851894532026737 09/01/22-00:03:32.055555
SID:	2026737
Source Port:	51894
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854434532829498 09/01/22-00:03:36.001169
SID:	2829498
Source Port:	54434
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859768532026737 09/01/22-00:03:34.095324
SID:	2026737
Source Port:	59768
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853054532829498 09/01/22-00:02:15.078816
SID:	2829498
Source Port:	53054
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863448532829498 09/01/22-00:02:35.455212
SID:	2829498
Source Port:	63448
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865111532829500 09/01/22-00:01:46.954181
SID:	2829500
Source Port:	65111
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853627532026737 09/01/22-00:02:01.832804
SID:	2026737
Source Port:	53627
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865200532829500 09/01/22-00:02:04.820486
SID:	2829500
Source Port:	65200
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855461532829498 09/01/22-00:03:07.325312
SID:	2829498
Source Port:	55461
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865390532026737 09/01/22-00:02:38.738598
SID:	2026737
Source Port:	65390
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865516532829500 09/01/22-00:02:19.492210
SID:	2829500
Source Port:	65516
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855654532829498 09/01/22-00:03:19.297074
SID:	2829498
Source Port:	55654
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854288532829500 09/01/22-00:03:33.756470
SID:	2829500
Source Port:	54288
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865515532829500 09/01/22-00:02:19.472414
SID:	2829500
Source Port:	65515
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859767532026737 09/01/22-00:03:34.075907
SID:	2026737
Source Port:	59767
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860649532829498 09/01/22-00:03:25.341169
SID:	2829498
Source Port:	60649
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853628532026737 09/01/22-00:02:01.851234
SID:	2026737
Source Port:	53628
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864970532829500 09/01/22-00:02:44.867082
SID:	2829500
Source Port:	64970
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862434532026737 09/01/22-00:02:57.492445
SID:	2026737
Source Port:	62434
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859583532026737 09/01/22-00:02:11.706174
SID:	2026737
Source Port:	59583
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850232532026737 09/01/22-00:02:54.777871
SID:	2026737
Source Port:	50232
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852959532829500 09/01/22-00:01:25.367458
SID:	2829500
Source Port:	52959
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850787532026737 09/01/22-00:02:43.367194
SID:	2026737
Source Port:	50787
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858123532829498 09/01/22-00:02:27.969558
SID:	2829498
Source Port:	58123
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860423532829498 09/01/22-00:03:32.424188
SID:	2829498
Source Port:	60423
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865201532829500 09/01/22-00:02:04.842170
SID:	2829500
Source Port:	65201
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854157532829498 09/01/22-00:02:39.751533
SID:	2829498
Source Port:	54157
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865112532829500 09/01/22-00:01:46.974641
SID:	2829500
Source Port:	65112
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859830532829500 09/01/22-00:02:55.974495
SID:	2829500
Source Port:	59830
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855460532829498 09/01/22-00:03:07.301197
SID:	2829498
Source Port:	55460
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853307532829500 09/01/22-00:01:54.875889
SID:	2829500
Source Port:	53307
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851595532026737 09/01/22-00:03:26.929732
SID:	2026737
Source Port:	51595
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856044532829500 09/01/22-00:01:38.460693
SID:	2829500
Source Port:	56044
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857828532829500 09/01/22-00:03:23.000023
SID:	2829500
Source Port:	57828
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864606532829500 09/01/22-00:02:41.903320
SID:	2829500
Source Port:	64606
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853273532829498 09/01/22-00:02:55.304130
SID:	2829498
Source Port:	53273
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856047532829500 09/01/22-00:01:38.529181
SID:	2829500
Source Port:	56047
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850626532026737 09/01/22-00:03:18.717464
SID:	2026737
Source Port:	50626
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863691532829498 09/01/22-00:03:21.687512
SID:	2829498
Source Port:	63691
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859825532026737 09/01/22-00:02:20.014612
SID:	2026737
Source Port:	59825
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855954532829500 09/01/22-00:03:25.612012
SID:	2829500
Source Port:	55954
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862428532026737 09/01/22-00:03:13.188986
SID:	2026737
Source Port:	62428
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861419532829498 09/01/22-00:02:03.004767
SID:	2829498
Source Port:	61419
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860474532829498 09/01/22-00:02:47.119975
SID:	2829498
Source Port:	60474
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864274532829498 09/01/22-00:03:00.057400
SID:	2829498
Source Port:	64274
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853853532026737 09/01/22-00:01:50.543832
SID:	2026737
Source Port:	53853
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855248532829498 09/01/22-00:03:03.486266
SID:	2829498
Source Port:	55248
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853432532829498 09/01/22-00:02:18.428585
SID:	2829498
Source Port:	53432
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853849532829498 09/01/22-00:01:59.483040
SID:	2829498
Source Port:	53849
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859586532026737 09/01/22-00:02:11.767488
SID:	2026737
Source Port:	59586
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860477532829498 09/01/22-00:02:47.180255
SID:	2829498
Source Port:	60477
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852743532026737 09/01/22-00:03:23.998658
SID:	2026737
Source Port:	52743
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849170532829500 09/01/22-00:02:32.467435
SID:	2829500
Source Port:	49170
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865325532026737 09/01/22-00:01:43.903174
SID:	2026737
Source Port:	65325
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857575532829498 09/01/22-00:01:53.271847
SID:	2829498
Source Port:	57575
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849879532829500 09/01/22-00:02:36.072251
SID:	2829500
Source Port:	49879
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859640532026737 09/01/22-00:01:39.971866
SID:	2026737
Source Port:	59640
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865109532829500 09/01/22-00:01:46.914019
SID:	2829500
Source Port:	65109
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863450532829498 09/01/22-00:02:35.496675
SID:	2829498
Source Port:	63450
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860646532829498 09/01/22-00:03:25.281760
SID:	2829498
Source Port:	60646
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854285532829500 09/01/22-00:03:33.695070
SID:	2829500
Source Port:	54285
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858915532829500 09/01/22-00:03:18.040653
SID:	2829500
Source Port:	58915
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864974532829500 09/01/22-00:03:05.683602
SID:	2829500
Source Port:	64974
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858482532829500 09/01/22-00:03:29.362481
SID:	2829500
Source Port:	58482
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864125532829498 09/01/22-00:02:44.347197
SID:	2829498
Source Port:	64125
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859437532026737 09/01/22-00:01:57.658266
SID:	2026737
Source Port:	59437
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857137532829498 09/01/22-00:01:34.192981
SID:	2829498
Source Port:	57137
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860819532829500 09/01/22-00:03:08.807703
SID:	2829500
Source Port:	60819
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864598532829498 09/01/22-00:02:22.069673
SID:	2829498
Source Port:	64598
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865388532026737 09/01/22-00:02:38.683294
SID:	2026737
Source Port:	65388
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852460532026737 09/01/22-00:03:02.922606
SID:	2026737
Source Port:	52460
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861361532829498 09/01/22-00:03:28.363595
SID:	2829498
Source Port:	61361
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865464532829500 09/01/22-00:03:37.331573
SID:	2829500
Source Port:	65464
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863566532026737 09/01/22-00:02:17.069143
SID:	2026737
Source Port:	63566
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849203532026737 09/01/22-00:02:46.656883
SID:	2026737
Source Port:	49203
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864972532829500 09/01/22-00:03:05.639386
SID:	2829500
Source Port:	64972
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853051532829498 09/01/22-00:02:15.015452
SID:	2829498
Source Port:	53051
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851995532026737 09/01/22-00:02:26.294405
SID:	2026737
Source Port:	51995
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851107532829500 09/01/22-00:03:01.623107
SID:	2829500
Source Port:	51107
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864969532829500 09/01/22-00:02:44.846895
SID:	2829500
Source Port:	64969
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852113532026737 09/01/22-00:03:20.304409
SID:	2026737
Source Port:	52113
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858121532829498 09/01/22-00:02:27.883460
SID:	2829498
Source Port:	58121
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857707532829500 09/01/22-00:01:42.707644
SID:	2829500
Source Port:	57707
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861420532829498 09/01/22-00:02:03.023139
SID:	2829498
Source Port:	61420
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860772532829498 09/01/22-00:01:45.515640
SID:	2829498
Source Port:	60772
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859379532829500 09/01/22-00:02:48.360270
SID:	2829500
Source Port:	59379
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860420532829498 09/01/22-00:03:32.361100
SID:	2829498
Source Port:	60420
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858306532026737 09/01/22-00:02:34.518930
SID:	2026737
Source Port:	58306
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857136532829498 09/01/22-00:01:34.170593
SID:	2829498
Source Port:	57136
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863692532829498 09/01/22-00:03:21.709351
SID:	2829498
Source Port:	63692
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851110532829500 09/01/22-00:03:01.687030
SID:	2829500
Source Port:	51110
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855651532829498 09/01/22-00:03:19.239137
SID:	2829498
Source Port:	55651
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861187532829498 09/01/22-00:02:52.669551
SID:	2829498
Source Port:	61187
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850789532026737 09/01/22-00:02:43.405655
SID:	2026737
Source Port:	50789
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864126532829498 09/01/22-00:02:44.367092
SID:	2829498
Source Port:	64126
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856045532829500 09/01/22-00:01:38.479108
SID:	2829500
Source Port:	56045
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849876532829500 09/01/22-00:02:36.017097
SID:	2829500
Source Port:	49876
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853430532829498 09/01/22-00:02:18.389778
SID:	2829498
Source Port:	53430
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864275532829498 09/01/22-00:03:00.076893
SID:	2829498
Source Port:	64275
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852746532026737 09/01/22-00:03:24.060420
SID:	2026737
Source Port:	52746
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865199532829500 09/01/22-00:02:04.790776
SID:	2829500
Source Port:	65199
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855643532829498 09/01/22-00:01:41.349610
SID:	2829498
Source Port:	55643
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865322532026737 09/01/22-00:01:43.838373
SID:	2026737
Source Port:	65322
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857389532829500 09/01/22-00:02:53.228134
SID:	2829500
Source Port:	57389
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852457532026737 09/01/22-00:03:02.822494
SID:	2026737
Source Port:	52457
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859766532026737 09/01/22-00:03:34.053456
SID:	2026737
Source Port:	59766
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850094532026737 09/01/22-00:03:38.722516
SID:	2026737
Source Port:	50094
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863689532829498 09/01/22-00:03:21.642301
SID:	2829498
Source Port:	63689
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864828532829500 09/01/22-00:02:24.814616
SID:	2829500
Source Port:	64828
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862427532026737 09/01/22-00:03:13.168037
SID:	2026737
Source Port:	62427
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858485532829500 09/01/22-00:03:30.012594
SID:	2829500
Source Port:	58485
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860586532026737 09/01/22-00:01:27.526553
SID:	2026737
Source Port:	60586
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860648532829498 09/01/22-00:03:25.320562
SID:	2829498
Source Port:	60648
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850231532026737 09/01/22-00:02:54.755739
SID:	2026737
Source Port:	50231
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859831532829500 09/01/22-00:02:55.995864
SID:	2829500
Source Port:	59831
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857138532829498 09/01/22-00:01:34.214783
SID:	2829498
Source Port:	57138
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865465532829500 09/01/22-00:03:37.351949
SID:	2829500
Source Port:	65465
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859641532026737 09/01/22-00:01:39.990388
SID:	2026737
Source Port:	59641
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859638532026737 09/01/22-00:01:39.931325
SID:	2026737
Source Port:	59638
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854435532829498 09/01/22-00:03:36.023381
SID:	2829498
Source Port:	54435
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860818532829500 09/01/22-00:03:08.745097
SID:	2829500
Source Port:	60818
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857576532829498 09/01/22-00:01:53.290249
SID:	2829498
Source Port:	57576
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849171532829500 09/01/22-00:02:32.489443
SID:	2829500
Source Port:	49171
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851144532829498 09/01/22-00:01:24.145242
SID:	2829498
Source Port:	51144
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852115532026737 09/01/22-00:03:20.348262
SID:	2026737
Source Port:	52115
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856620532026737 09/01/22-00:02:49.146584
SID:	2026737
Source Port:	56620
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851109532829500 09/01/22-00:03:01.665772
SID:	2829500
Source Port:	51109
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864379532829500 09/01/22-00:03:19.992460
SID:	2829500
Source Port:	64379
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864599532829498 09/01/22-00:02:22.089885
SID:	2829498
Source Port:	64599
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860821532829500 09/01/22-00:03:08.846909
SID:	2829500
Source Port:	60821
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849205532026737 09/01/22-00:02:46.696702
SID:	2026737
Source Port:	49205
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849878532829500 09/01/22-00:02:36.053729
SID:	2829500
Source Port:	49878
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853846532829498 09/01/22-00:01:59.423880
SID:	2829498
Source Port:	53846
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860091532829500 09/01/22-00:02:16.509694
SID:	2829500
Source Port:	60091
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859377532829500 09/01/22-00:02:48.283085
SID:	2829500
Source Port:	59377
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859824532026737 09/01/22-00:02:19.994370
SID:	2026737
Source Port:	59824
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864607532829500 09/01/22-00:02:41.921899
SID:	2829500
Source Port:	64607
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855249532829498 09/01/22-00:03:03.506251
SID:	2829498
Source Port:	55249
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864380532829500 09/01/22-00:03:20.011368
SID:	2829500
Source Port:	64380
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850092532026737 09/01/22-00:03:38.678470
SID:	2026737
Source Port:	50092
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853272532829498 09/01/22-00:02:55.282821
SID:	2829498
Source Port:	53272
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857392532829500 09/01/22-00:02:53.296910
SID:	2829500
Source Port:	57392
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858916532829500 09/01/22-00:03:18.060823
SID:	2829500
Source Port:	58916
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853053532829498 09/01/22-00:02:15.057233
SID:	2829498
Source Port:	53053
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864826532829500 09/01/22-00:02:24.770961
SID:	2829500
Source Port:	64826
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853625532026737 09/01/22-00:02:01.788642
SID:	2026737
Source Port:	53625
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851596532026737 09/01/22-00:03:26.954769
SID:	2026737
Source Port:	51596
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862435532026737 09/01/22-00:02:57.512287
SID:	2026737
Source Port:	62435
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853852532026737 09/01/22-00:01:50.489647
SID:	2026737
Source Port:	53852
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862429532026737 09/01/22-00:03:13.209944
SID:	2026737
Source Port:	62429
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860584532026737 09/01/22-00:01:27.482735
SID:	2026737
Source Port:	60584
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864124532829498 09/01/22-00:02:44.327136
SID:	2829498
Source Port:	64124
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861189532829498 09/01/22-00:02:52.764321
SID:	2829498
Source Port:	61189
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849168532829500 09/01/22-00:02:32.423642
SID:	2829500
Source Port:	49168
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863451532829498 09/01/22-00:02:35.516825
SID:	2829498
Source Port:	63451
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850625532026737 09/01/22-00:03:18.697259
SID:	2026737
Source Port:	50625
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854286532829500 09/01/22-00:03:33.715891
SID:	2829500
Source Port:	54286
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860769532829498 09/01/22-00:01:45.451637
SID:	2829498
Source Port:	60769
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852744532026737 09/01/22-00:03:24.019183
SID:	2026737
Source Port:	52744
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855641532829498 09/01/22-00:01:41.302395
SID:	2829498
Source Port:	55641
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853469532829500 09/01/22-00:02:00.624524
SID:	2829500
Source Port:	53469
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860770532829498 09/01/22-00:01:45.473540
SID:	2829498
Source Port:	60770
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853470532829500 09/01/22-00:02:00.646017
SID:	2829500
Source Port:	53470
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865324532026737 09/01/22-00:01:43.883100
SID:	2026737
Source Port:	65324
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853851532026737 09/01/22-00:01:50.267332
SID:	2026737
Source Port:	53851
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862433532026737 09/01/22-00:02:57.467935
SID:	2026737
Source Port:	62433
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859584532026737 09/01/22-00:02:11.726579
SID:	2026737
Source Port:	59584
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860475532829498 09/01/22-00:02:47.139274
SID:	2829498
Source Port:	60475
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864123532829498 09/01/22-00:02:44.306860
SID:	2829498
Source Port:	64123
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858483532829500 09/01/22-00:03:29.383909
SID:	2829500
Source Port:	58483
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856618532026737 09/01/22-00:02:49.105935
SID:	2026737
Source Port:	56618
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855247532829498 09/01/22-00:03:03.466197
SID:	2829498
Source Port:	55247
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861362532829498 09/01/22-00:03:28.520063
SID:	2829498
Source Port:	61362
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861129532829498 09/01/22-00:03:15.922110
SID:	2829498
Source Port:	61129
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857574532829498 09/01/22-00:01:53.251460
SID:	2829498
Source Port:	57574
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864597532829498 09/01/22-00:02:22.051454
SID:	2829498
Source Port:	64597
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858303532026737 09/01/22-00:02:34.435886
SID:	2026737
Source Port:	58303
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865387532026737 09/01/22-00:02:38.660218
SID:	2026737
Source Port:	65387
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853274532829498 09/01/22-00:02:55.325848
SID:	2829498
Source Port:	53274
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851594532026737 09/01/22-00:03:26.907030
SID:	2026737
Source Port:	51594
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863565532026737 09/01/22-00:02:17.049623
SID:	2026737
Source Port:	63565
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850627532026737 09/01/22-00:03:18.737468
SID:	2026737
Source Port:	50627
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858124532829498 09/01/22-00:02:27.993076
SID:	2829498
Source Port:	58124
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850786532026737 09/01/22-00:02:43.346779
SID:	2026737
Source Port:	50786
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850233532026737 09/01/22-00:02:54.805593
SID:	2026737
Source Port:	50233
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854287532829500 09/01/22-00:03:33.736226
SID:	2829500
Source Port:	54287
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864605532829500 09/01/22-00:02:41.882665
SID:	2829500
Source Port:	64605
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864604532829500 09/01/22-00:02:41.862105
SID:	2829500
Source Port:	64604
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855246532829498 09/01/22-00:03:03.448041
SID:	2829498
Source Port:	55246
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855953532829500 09/01/22-00:03:25.594151
SID:	2829500
Source Port:	55953
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858484532829500 09/01/22-00:03:29.402067
SID:	2829500
Source Port:	58484
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857139532829498 09/01/22-00:01:34.235761
SID:	2829498
Source Port:	57139
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859435532026737 09/01/22-00:01:57.617695
SID:	2026737
Source Port:	59435
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863564532026737 09/01/22-00:02:17.026690
SID:	2026737
Source Port:	63564
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852958532829500 09/01/22-00:01:25.347118
SID:	2829500
Source Port:	52958
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860092532829500 09/01/22-00:02:16.532570
SID:	2829500
Source Port:	60092
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863690532829498 09/01/22-00:03:21.664385
SID:	2829498
Source Port:	63690
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858304532026737 09/01/22-00:02:34.463044
SID:	2026737
Source Port:	58304
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855459532829498 09/01/22-00:03:07.276022
SID:	2829498
Source Port:	55459
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860476532829498 09/01/22-00:02:47.160135
SID:	2829498
Source Port:	60476
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865110532829500 09/01/22-00:01:46.934130
SID:	2829500
Source Port:	65110
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863449532829498 09/01/22-00:02:35.476503
SID:	2829498
Source Port:	63449
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852960532829500 09/01/22-00:01:25.385522
SID:	2829500
Source Port:	52960
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857390532829500 09/01/22-00:02:53.250639
SID:	2829500
Source Port:	57390
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857573532829498 09/01/22-00:01:53.226527
SID:	2829498
Source Port:	57573
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865514532829500 09/01/22-00:02:19.450712
SID:	2829500
Source Port:	65514
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861131532829498 09/01/22-00:03:15.960645
SID:	2829498
Source Port:	61131
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851141532829498 09/01/22-00:01:24.068248
SID:	2829498
Source Port:	51141
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853052532829498 09/01/22-00:02:15.036327
SID:	2829498
Source Port:	53052
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861128532829498 09/01/22-00:03:15.903464
SID:	2829498
Source Port:	61128
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852745532026737 09/01/22-00:03:24.040007
SID:	2026737
Source Port:	52745
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854156532829498 09/01/22-00:02:39.730598
SID:	2829498
Source Port:	54156
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857709532829500 09/01/22-00:01:42.750967
SID:	2829500
Source Port:	57709
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861363532829498 09/01/22-00:03:28.538480
SID:	2829498
Source Port:	61363
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853308532829500 09/01/22-00:01:54.898418
SID:	2829500
Source Port:	53308
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860585532026737 09/01/22-00:01:27.503002
SID:	2026737
Source Port:	60585
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860771532829498 09/01/22-00:01:45.495695
SID:	2829498
Source Port:	60771
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860422532829498 09/01/22-00:03:32.403375
SID:	2829498
Source Port:	60422
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850093532026737 09/01/22-00:03:38.699985
SID:	2026737
Source Port:	50093
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853041532026737 09/01/22-00:03:06.319112
SID:	2026737
Source Port:	53041
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851994532026737 09/01/22-00:02:26.273853
SID:	2026737
Source Port:	51994
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858917532829500 09/01/22-00:03:18.082512
SID:	2829500
Source Port:	58917
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864827532829500 09/01/22-00:02:24.792802
SID:	2829500
Source Port:	64827
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860820532829500 09/01/22-00:03:08.828384
SID:	2829500
Source Port:	60820
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851997532026737 09/01/22-00:02:26.333413
SID:	2026737
Source Port:	51997
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861188532829498 09/01/22-00:02:52.691629
SID:	2829498
Source Port:	61188
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859832532829500 09/01/22-00:02:56.017085
SID:	2829500
Source Port:	59832
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864600532829498 09/01/22-00:02:22.108885
SID:	2829498
Source Port:	64600
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855640532829498 09/01/22-00:01:41.280696
SID:	2829498
Source Port:	55640
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855462532829498 09/01/22-00:03:07.346617
SID:	2829498
Source Port:	55462
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859639532026737 09/01/22-00:01:39.951734
SID:	2026737
Source Port:	59639
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855653532829498 09/01/22-00:03:19.277165
SID:	2829498
Source Port:	55653
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857826532829500 09/01/22-00:03:22.956962
SID:	2829500
Source Port:	57826
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 1 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853847532829498 09/01/22-00:01:59.444336
SID:	2829498
Source Port:	53847
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851108532829500 09/01/22-00:03:01.644612
SID:	2829500
Source Port:	51108
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852459532026737 09/01/22-00:03:02.900983
SID:	2026737
Source Port:	52459
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864381532829500 09/01/22-00:03:20.034172
SID:	2829500
Source Port:	64381
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853626532026737 09/01/22-00:02:01.814516
SID:	2026737
Source Port:	53626
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859823532026737 09/01/22-00:02:19.973756
SID:	2026737
Source Port:	59823
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851892532026737 09/01/22-00:03:31.996527
SID:	2026737
Source Port:	51892
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed GandCrab Domain (gandcrab .bit) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856621532026737 09/01/22-00:02:49.211680
SID:	2026737
Source Port:	56621
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GandCrab DNS Lookup 3 - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855956532829500 09/01/22-00:03:25.650230
SID:	2829500
Source Port:	55956
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 9gkAKTWOXp.exe	Virustotal: Detection: 81%	Perma Link
Source: 9gkAKTWOXp.exe	Metadefender: Detection: 72%	Perma Link
Source: 9gkAKTWOXp.exe	ReversingLabs: Detection: 100%

Antivirus / Scanner detection for submitted sample

Source: 9gkAKTWOXp.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de	Avira URL Cloud: Label: malware
Source: http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen3

Machine Learning detection for sample

Source: 9gkAKTWOXp.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe

Joe Sandbox ML: detected

Source: 13.0.vkspii.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 1.2.9gkAKTWOXp.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 13.2.vkspii.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 21.2.vkspii.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 1.0.9gkAKTWOXp.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 21.0.vkspii.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00405750 VirtualAlloc,CryptBinaryToStringA,CryptBinaryToStringA,CryptBinaryToStringA,lstrlenA,lstrlenA,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatW,lstrcatW,lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenA,lstrlenW,MultiByteToWideChar,lstrcatW,lstrlenW,lstrlenA,lstrlenW,MultiByteToWideChar,lstrcatW,lstrlenW,lstrlenW,VirtualAlloc,lstrlenW,lstrlenW,_memset,lstrlenA,lstrlenA,CryptBinaryToStringA,GetLastError,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,MultiByteToWideChar,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00407C60 CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00405D80 CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextW,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_004048A0 Sleep,ExitProcess,CreateThread,WaitForSingleObject,TerminateThread,CloseHandle,ExitProcess,Sleep,lstrlenA,VirtualAlloc,CryptStringToBinaryA,ExitProcess,InitializeCriticalSection,DeleteCriticalSection,VirtualAlloc,GetModuleFileNameW,VirtualFree,ShellExecuteW,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00407DB0 VirtualAlloc,CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00405540 VirtualAlloc,wsprintfW,lstrlenW,lstrlenW,lstrlenW,_memset,lstrlenA,lstrlenW,lstrlenW,CryptBinaryToStringA,GetLastError,lstrlenA,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,VirtualFree,VirtualFree,VirtualFree,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00405050 lstrlenA,VirtualAlloc,VirtualAlloc,CryptStringToBinaryA,_memset,lstrlenA,lstrlenA,VirtualAlloc,CryptStringToBinaryA,VirtualAlloc,MultiByteToWideChar,GetLastError,VirtualAlloc,VirtualFree,lstrlenA,VirtualAlloc,lstrcpyA,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,VirtualFree,GetLastError,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00406000 EnterCriticalSection,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptImportKey,CryptGetKeyParam,CryptEncrypt,GetLastError,CryptReleaseContext,LeaveCriticalSection,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_004048A0 Sleep,ExitProcess,CreateThread,WaitForSingleObject,TerminateThread,CloseHandle,ExitProcess,Sleep,lstrlenA,VirtualAlloc,CryptStringToBinaryA,ExitProcess,InitializeCriticalSection,DeleteCriticalSection,VirtualAlloc,GetModuleFileNameW,VirtualFree,ShellExecuteW,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00405540 VirtualAlloc,wsprintfW,lstrlenW,lstrlenW,lstrlenW,_memset,lstrlenA,lstrlenW,lstrlenW,CryptBinaryToStringA,GetLastError,lstrlenA,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,VirtualFree,VirtualFree,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00405750 VirtualAlloc,CryptBinaryToStringA,CryptBinaryToStringA,CryptBinaryToStringA,lstrlenA,lstrlenA,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatW,lstrcatW,lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenA,lstrlenW,MultiByteToWideChar,lstrcatW,lstrlenW,lstrlenA,lstrlenW,MultiByteToWideChar,lstrcatW,lstrlenW,lstrlenW,VirtualAlloc,lstrlenW,lstrlenW,_memset,lstrlenA,lstrlenA,CryptBinaryToStringA,GetLastError,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,MultiByteToWideChar,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00405050 lstrlenA,VirtualAlloc,VirtualAlloc,CryptStringToBinaryA,_memset,lstrlenA,lstrlenA,VirtualAlloc,CryptStringToBinaryA,VirtualAlloc,MultiByteToWideChar,GetLastError,VirtualAlloc,VirtualFree,lstrlenA,VirtualAlloc,lstrcpyA,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,VirtualFree,GetLastError,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00407C60 CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00406000 EnterCriticalSection,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptImportKey,CryptGetKeyParam,CryptEncrypt,GetLastError,CryptReleaseContext,LeaveCriticalSection,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00405D80 CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextW,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00407DB0 VirtualAlloc,CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_004048A0 Sleep,ExitProcess,CreateThread,WaitForSingleObject,TerminateThread,CloseHandle,ExitProcess,Sleep,lstrlenA,VirtualAlloc,CryptStringToBinaryA,ExitProcess,InitializeCriticalSection,DeleteCriticalSection,VirtualAlloc,GetModuleFileNameW,VirtualFree,ShellExecuteW,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00405540 VirtualAlloc,wsprintfW,lstrlenW,lstrlenW,lstrlenW,_memset,lstrlenA,lstrlenW,lstrlenW,CryptBinaryToStringA,GetLastError,lstrlenA,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,VirtualFree,VirtualFree,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00405750 VirtualAlloc,CryptBinaryToStringA,CryptBinaryToStringA,CryptBinaryToStringA,lstrlenA,lstrlenA,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatW,lstrcatW,lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenA,lstrlenW,MultiByteToWideChar,lstrcatW,lstrlenW,lstrlenA,lstrlenW,MultiByteToWideChar,lstrcatW,lstrlenW,lstrlenW,VirtualAlloc,lstrlenW,lstrlenW,_memset,lstrlenA,lstrlenA,CryptBinaryToStringA,GetLastError,lstrlenA,VirtualAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,MultiByteToWideChar,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00405050 lstrlenA,VirtualAlloc,VirtualAlloc,CryptStringToBinaryA,_memset,lstrlenA,lstrlenA,VirtualAlloc,CryptStringToBinaryA,VirtualAlloc,MultiByteToWideChar,GetLastError,VirtualAlloc,VirtualFree,lstrlenA,VirtualAlloc,lstrcpyA,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,VirtualFree,GetLastError,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00407C60 CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00406000 EnterCriticalSection,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptImportKey,CryptGetKeyParam,CryptEncrypt,GetLastError,CryptReleaseContext,LeaveCriticalSection,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00405D80 CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextW,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00407DB0 VirtualAlloc,CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,

Source: 9gkAKTWOXp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9gkAKTWOXp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: z:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: x:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: v:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: t:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: r:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: p:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: n:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: l:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: j:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: h:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: f:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: b:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: y:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: w:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: u:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: s:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: q:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: o:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: m:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: k:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: i:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: g:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: e:
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File opened: a:

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_004066F0 lstrlenW,lstrcatW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_004064A0 lstrlenW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcatW,lstrlenW,lstrcmpW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,lstrlenA,VirtualFree,CloseHandle,lstrcmpW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_004066F0 lstrlenW,lstrcatW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_004064A0 lstrlenW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcatW,lstrlenW,lstrcmpW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,lstrlenA,VirtualFree,CloseHandle,lstrcmpW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_004066F0 lstrlenW,lstrcatW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_004064A0 lstrlenW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcatW,lstrlenW,lstrcmpW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,lstrlenA,VirtualFree,CloseHandle,lstrcmpW,FindNextFileW,FindClose,

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:51141 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:51142 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:51143 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:51144 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:52957 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:52958 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:52959 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:52960 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:60584 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:60585 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:60586 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:60587 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57136 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57137 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57138 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57139 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:56044 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:56045 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:56046 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:56047 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59638 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59639 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59640 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59641 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55640 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55641 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55642 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55643 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57706 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57707 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57708 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57709 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65322 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65323 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65324 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65325 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60769 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60770 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60771 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60772 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65109 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65110 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65111 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65112 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53850 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53851 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53852 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53853 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57573 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57574 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57575 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:57576 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53307 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53308 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53309 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53310 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59435 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59436 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59437 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59438 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53846 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53847 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53848 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53849 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53468 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53469 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53470 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:53471 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53625 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53626 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53627 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53628 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61418 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61419 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61420 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61421 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65198 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65199 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65200 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65201 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59583 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59584 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59585 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59586 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53051 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53052 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53053 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53054 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60090 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60091 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60092 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60093 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:63564 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:63565 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:63566 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:63567 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53430 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53431 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53432 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53433 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65513 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65514 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65515 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65516 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59822 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59823 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59824 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59825 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64597 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64598 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64599 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64600 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64825 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64826 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64827 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64828 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51994 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51995 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51996 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51997 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:58121 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:58122 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:58123 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:58124 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49168 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49169 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49170 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49171 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:58303 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:58304 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:58305 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:58306 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63448 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63449 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63450 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63451 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49876 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49877 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49878 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:49879 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65387 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65388 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65389 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:65390 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54155 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54156 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54157 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54158 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64604 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64605 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64606 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64607 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50786 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50787 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50788 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50789 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64123 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64124 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64125 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64126 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64969 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64970 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64971 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64972 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:49203 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:49204 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:49205 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:49206 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60474 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60475 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60476 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60477 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59376 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59377 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59378 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59379 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:56618 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:56619 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:56620 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:56621 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61186 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61187 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61188 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61189 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57389 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57390 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57391 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57392 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50230 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50231 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50232 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50233 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53271 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53272 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53273 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:53274 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59829 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59830 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59831 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:59832 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62433 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62434 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62435 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62436 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64273 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64274 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64275 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:64276 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:51107 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:51108 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:51109 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:51110 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52457 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52458 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52459 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52460 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55246 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55247 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55248 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55249 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64973 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64974 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53039 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53040 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53041 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:53042 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55459 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55460 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55461 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55462 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60818 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60819 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60820 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:60821 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62426 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62427 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62428 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:62429 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61128 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61129 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61130 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61131 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58914 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58915 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58916 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58917 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50624 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50625 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50626 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50627 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55651 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55652 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55653 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:55654 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64378 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64379 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64380 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:64381 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52112 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52113 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52114 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52115 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63689 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63690 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63691 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:63692 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57826 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57827 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57828 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:57829 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52743 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52744 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52745 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:52746 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60646 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60647 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60648 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60649 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:55953 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:55954 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:55955 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:55956 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51594 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51595 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51596 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51597 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61361 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61362 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61363 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:61364 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58482 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58483 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58484 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:58485 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51891 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51892 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51893 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:51894 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60420 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60421 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60422 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:60423 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:54285 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:54286 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:54287 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:54288 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59765 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59766 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59767 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:59768 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54433 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54434 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54435 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829498 ETPRO TROJAN GandCrab DNS Lookup 1 192.168.2.3:54436 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65463 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65464 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65465 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2829500 ETPRO TROJAN GandCrab DNS Lookup 3 192.168.2.3:65466 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50092 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50093 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50094 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2026737 ET TROJAN Observed GandCrab Domain (gandcrab .bit) 192.168.2.3:50095 -> 8.8.8.8:53

Contains functionality to determine the online IP of the system

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_004068F0 VirtualAlloc,VirtualAlloc,lstrlenW,lstrlenA,wsprintfW,VirtualFree,InternetCloseHandle, ipv4bot.whatismyipaddress.com
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_004068F0 VirtualAlloc,VirtualAlloc,lstrlenW,lstrlenA,wsprintfW,VirtualFree,InternetCloseHandle, ipv4bot.whatismyipaddress.com
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_004068F0 VirtualAlloc,VirtualAlloc,lstrlenW,lstrlenA,wsprintfW,VirtualFree,InternetCloseHandle, ipv4bot.whatismyipaddress.com
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_004068F0 VirtualAlloc,VirtualAlloc,lstrlenW,lstrlenA,wsprintfW,VirtualFree,InternetCloseHandle, ipv4bot.whatismyipaddress.com
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_004068F0 VirtualAlloc,VirtualAlloc,lstrlenW,lstrlenA,wsprintfW,VirtualFree,InternetCloseHandle, ipv4bot.whatismyipaddress.com
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_004068F0 VirtualAlloc,VirtualAlloc,lstrlenW,lstrlenA,wsprintfW,VirtualFree,InternetCloseHandle, ipv4bot.whatismyipaddress.com

Found Tor onion address

Source: 9gkAKTWOXp.exe, 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: 9gkAKTWOXp.exe, 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: vkspii.exe, 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: vkspii.exe, 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: vkspii.exe, 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: vkspii.exe, 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: vkspii.exe, 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: vkspii.exe, 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: vkspii.exe, 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: vkspii.exe, 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: vkspii.exe, 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: vkspii.exe, 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: vkspii.exe, 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: vkspii.exe, 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: vkspii.exe, 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: 9gkAKTWOXp.exe	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: 9gkAKTWOXp.exe	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: 9gkAKTWOXp.exe	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: 9gkAKTWOXp.exe	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: 9gkAKTWOXp.exe	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: 9gkAKTWOXp.exe	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: vkspii.exe.1.dr	String found in binary or memory: 4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: vkspii.exe.1.dr	String found in binary or memory: 1. http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: vkspii.exe.1.dr	String found in binary or memory: 2. http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: vkspii.exe.1.dr	String found in binary or memory: 3. http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: vkspii.exe.1.dr	String found in binary or memory: 4. http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: vkspii.exe.1.dr	String found in binary or memory: 5. http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de

Uses nslookup.exe to query domains

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru

May check the online IP address of the machine

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	DNS query: name: ipv4bot.whatismyipaddress.com
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	DNS query: name: ipv4bot.whatismyipaddress.com
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	DNS query: name: ipv4bot.whatismyipaddress.com
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	DNS query: name: ipv4bot.whatismyipaddress.com
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	DNS query: name: ipv4bot.whatismyipaddress.com

Source: 9gkAKTWOXp.exe, vkspii.exe.1.dr	String found in binary or memory: http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de
Source: 9gkAKTWOXp.exe, vkspii.exe.1.dr	String found in binary or memory: http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de
Source: 9gkAKTWOXp.exe, vkspii.exe.1.dr	String found in binary or memory: http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de
Source: 9gkAKTWOXp.exe, vkspii.exe.1.dr	String found in binary or memory: http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de
Source: 9gkAKTWOXp.exe, vkspii.exe.1.dr	String found in binary or memory: http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de
Source: 9gkAKTWOXp.exe, vkspii.exe.1.dr	String found in binary or memory: http://gdcbghvjyqy7jclk.onion/e644d32fec6144de
Source: 9gkAKTWOXp.exe, vkspii.exe.1.dr	String found in binary or memory: https://www.torproject.org/

Source: unknown

DNS traffic detected: queries for: ipv4bot.whatismyipaddress.com

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00407A00 lstrcatW,InternetCloseHandle,InternetConnectW,VirtualAlloc,wsprintfW,HttpOpenRequestW,HttpAddRequestHeadersW,HttpSendRequestW,InternetReadFile,InternetReadFile,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,VirtualFree,

Spam, unwanted Advertisements and Ransom Demands

Yara detected Gandcrab

Source: Yara match	File source: 9gkAKTWOXp.exe, type: SAMPLE
Source: Yara match	File source: 13.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.295326787.000000000040E000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.305269157.000000000040E000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9gkAKTWOXp.exe PID: 4664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkspii.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkspii.exe PID: 4024, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, type: DROPPED

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00406000 EnterCriticalSection,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptImportKey,CryptGetKeyParam,CryptEncrypt,GetLastError,CryptReleaseContext,LeaveCriticalSection,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00406000 EnterCriticalSection,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptImportKey,CryptGetKeyParam,CryptEncrypt,GetLastError,CryptReleaseContext,LeaveCriticalSection,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00406000 EnterCriticalSection,CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptImportKey,CryptGetKeyParam,CryptEncrypt,GetLastError,CryptReleaseContext,LeaveCriticalSection,

Source: nslookup.exe

Process created: 43

System Summary

Malicious sample detected (through community Yara rule)

Source: 9gkAKTWOXp.exe, type: SAMPLE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 13.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.2.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 13.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 21.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.0.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 21.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, type: DROPPED	Matched rule: Gandcrab Payload Author: kevoreilly

Source: 9gkAKTWOXp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9gkAKTWOXp.exe, type: SAMPLE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 9gkAKTWOXp.exe, type: SAMPLE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 13.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 13.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.2.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 1.2.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 13.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 13.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 21.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 1.0.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 21.2.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.0.9gkAKTWOXp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 21.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 21.0.vkspii.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, type: DROPPED	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, type: DROPPED	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00402000
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_00407EE0
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00402000
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_00407EE0
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00402000
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_00407EE0

Source: 9gkAKTWOXp.exe	Virustotal: Detection: 81%
Source: 9gkAKTWOXp.exe	Metadefender: Detection: 72%
Source: 9gkAKTWOXp.exe	ReversingLabs: Detection: 100%

Source: 9gkAKTWOXp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\9gkAKTWOXp.exe "C:\Users\user\Desktop\9gkAKTWOXp.exe"
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe "C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe"
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe "C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe"
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Windows\SysWOW64\nslookup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@127/2@529/0

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00406D90 VirtualAlloc,VirtualAlloc,GetUserNameW,VirtualAlloc,GetComputerNameW,wsprintfW,VirtualAlloc,wsprintfW,VirtualAlloc,RegOpenKeyExW,RegQueryValueExW,GetLastError,RegCloseKey,VirtualFree,VirtualAlloc,VirtualAlloc,wsprintfW,RegOpenKeyExW,RegQueryValueExW,GetLastError,RegCloseKey,lstrcmpiW,wsprintfW,wsprintfW,VirtualFree,VirtualAlloc,VirtualAlloc,RegOpenKeyExW,RegQueryValueExW,GetLastError,RegCloseKey,wsprintfW,GetNativeSystemInfo,VirtualAlloc,wsprintfW,VirtualAlloc,VirtualAlloc,GetWindowsDirectoryW,GetVolumeInformationW,RegOpenKeyExW,RegQueryValueExW,GetLastError,RegCloseKey,lstrlenW,wsprintfW,lstrcatW,lstrcatW,GetModuleHandleW,GetProcAddress,lstrlenW,VirtualFree,lstrcatW,VirtualAlloc,GetDriveTypeW,lstrcatW,lstrcatW,lstrcatW,GetDiskFreeSpaceW,lstrlenW,wsprintfW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrlenW,VirtualAlloc,VirtualFree,

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00404640 CreateToolhelp32Snapshot,VirtualAlloc,Process32FirstW,CloseHandle,lstrcmpiW,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,Process32NextW,VirtualFree,FindCloseChangeNotification,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5360:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1976:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3196:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4272:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5500:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4184:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5116:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3184:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4820:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1328:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3880:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5920:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5460:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1944:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1360:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_01
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=66326910ce147b1b
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5208:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2140:120:WilError_01

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\nslookup.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 9gkAKTWOXp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00407C60 CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe

Jump to dropped file

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce qfkhrdewlal	Jump to behavior
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce qfkhrdewlal	Jump to behavior
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce qfkhrdewlal	Jump to behavior
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce qfkhrdewlal	Jump to behavior

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe TID: 4584	Thread sleep count: 80 > 30
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe TID: 4584	Thread sleep time: -800000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Evaded block: after key decision

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: EnumDeviceDrivers,K32EnumDeviceDrivers,VirtualAlloc,K32EnumDeviceDrivers,K32GetDeviceDriverBaseNameW,lstrcmpiW,VirtualFree,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: EnumDeviceDrivers,EnumDeviceDrivers,VirtualAlloc,EnumDeviceDrivers,GetDeviceDriverBaseNameW,lstrcmpiW,VirtualFree,VirtualFree,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: EnumDeviceDrivers,EnumDeviceDrivers,VirtualAlloc,EnumDeviceDrivers,GetDeviceDriverBaseNameW,lstrcmpiW,VirtualFree,VirtualFree,

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_004066F0 lstrlenW,lstrcatW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Code function: 1_2_004064A0 lstrlenW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcatW,lstrlenW,lstrcmpW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,lstrlenA,VirtualFree,CloseHandle,lstrcmpW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_004066F0 lstrlenW,lstrcatW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 13_2_004064A0 lstrlenW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcatW,lstrlenW,lstrcmpW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,lstrlenA,VirtualFree,CloseHandle,lstrcmpW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_004066F0 lstrlenW,lstrcatW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Code function: 21_2_004064A0 lstrlenW,lstrcatW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcatW,lstrlenW,lstrcmpW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,lstrlenA,VirtualFree,CloseHandle,lstrcmpW,FindNextFileW,FindClose,

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

System information queried: ModuleInformation

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00407C60 CryptAcquireContextW,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,CryptReleaseContext,VirtualFree,CryptReleaseContext,VirtualFree,

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00405050 lstrlenA,VirtualAlloc,VirtualAlloc,CryptStringToBinaryA,_memset,lstrlenA,lstrlenA,VirtualAlloc,CryptStringToBinaryA,VirtualAlloc,MultiByteToWideChar,GetLastError,VirtualAlloc,VirtualFree,lstrlenA,VirtualAlloc,lstrcpyA,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,VirtualFree,GetLastError,

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup emsisoft.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup gandcrab.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup nomoreransom.bit dns1.soprodns.ru
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00403A60 AllocateAndInitializeSid,GetModuleHandleA,GetProcAddress,FreeSid,

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Code function: 1_2_00408BC0 cpuid

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Desktop\9gkAKTWOXp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\9gkAKTWOXp.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	2 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	1 Replication Through Removable Media	11 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	1 Proxy	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Network Configuration Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	1 File and Directory Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	44 System Information Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9gkAKTWOXp.exe	81%	Virustotal		Browse
9gkAKTWOXp.exe	73%	Metadefender		Browse
9gkAKTWOXp.exe	100%	ReversingLabs	Win32.Ransomware.GandCrab
9gkAKTWOXp.exe	100%	Avira	TR/Crypt.XPACK.Gen3
9gkAKTWOXp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	100%	Avira	TR/Crypt.XPACK.Gen3
C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
13.0.vkspii.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
1.2.9gkAKTWOXp.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
13.2.vkspii.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
21.2.vkspii.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
1.0.9gkAKTWOXp.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
21.0.vkspii.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File

Domains

Source	Detection	Scanner	Label	Link
emsisoft.bit	0%	Virustotal		Browse
nomoreransom.bit	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de	100%	Avira URL Cloud	malware
http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de	100%	Avira URL Cloud	phishing
http://gdcbghvjyqy7jclk.onion/e644d32fec6144de	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
emsisoft.bit	unknown	unknown	true	0%, Virustotal, Browse	unknown
ipv4bot.whatismyipaddress.com	unknown	unknown	false		high
nomoreransom.bit	unknown	unknown	true	1%, Virustotal, Browse	unknown
gandcrab.bit	unknown	unknown	true		unknown
dns1.soprodns.ru	unknown	unknown	true		unknown
8.8.8.8.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.torproject.org/	9gkAKTWOXp.exe, vkspii.exe.1.dr	false		high
http://gdcbghvjyqy7jclk.onion.guide/e644d32fec6144de	9gkAKTWOXp.exe, vkspii.exe.1.dr	false		high
http://gdcbghvjyqy7jclk.onion.plus/e644d32fec6144de	9gkAKTWOXp.exe, vkspii.exe.1.dr	false		high
http://gdcbghvjyqy7jclk.onion.casa/e644d32fec6144de	9gkAKTWOXp.exe, vkspii.exe.1.dr	true	Avira URL Cloud: malware	unknown
http://gdcbghvjyqy7jclk.onion.top/e644d32fec6144de	9gkAKTWOXp.exe, vkspii.exe.1.dr	true	Avira URL Cloud: phishing	unknown
http://gdcbghvjyqy7jclk.onion/e644d32fec6144de	9gkAKTWOXp.exe, vkspii.exe.1.dr	true	Avira URL Cloud: safe	unknown
http://gdcbghvjyqy7jclk.onion.rip/e644d32fec6144de	9gkAKTWOXp.exe, vkspii.exe.1.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	694569
Start date and time:	2022-09-01 00:00:17 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	9gkAKTWOXp.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	62
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@127/2@529/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 96.9%) Quality average: 84.4% Quality standard deviation: 23.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.82.228.9, 20.82.154.241
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, fs.microsoft.com, eudb.ris.api.iris.microsoft.com, neus2c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neus1c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:01:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce qfkhrdewlal "C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe"
00:01:22	API Interceptor	80x Sleep call for process: 9gkAKTWOXp.exe modified
00:01:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce qfkhrdewlal "C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe"

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\Desktop\9gkAKTWOXp.exe
File Type:	data
Category:	dropped
Size (bytes):	2218
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F97F9E17EAFDD0105A4E11BAFDE04B40
SHA1:	BA06A7ABE986A61B71889B80A6F9B02B22D40667
SHA-256:	4783424121E6C2F870DC931B374D20C62C764EDDC5769D2F536609ADC1226ABB
SHA-512:	778C4AAB55F6F0FE44DBC9A97F53B59EC8ED2E35901F77AFEBAEA57C738AD301412760709AB909B51335DDD7676CD8F8C1410C5751F2EF5CC74282BCD6C5F50E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe

Download File

Process:	C:\Users\user\Desktop\9gkAKTWOXp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	4.804275425971981
Encrypted:	false
SSDEEP:	1536:ugSeGDjtQhnwmmB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv:uMSjOnrmBbMqqMmr3IdE8we0Avu5r++N
MD5:	551DA842D854798E9D42602EB420BD96
SHA1:	B44E2B41F17EC56135BE9ED3F545025078E912EC
SHA-256:	F54A4A6120B5236D4621F4D38F496E2025A352D19A191799DB53F38E60C9C7EA
SHA-512:	877A04DC6730634E59C9395291CE80AD4F049CA1C24AE7D064129AC5DE5F65A67A2F1FABA6486353CC2676D838CEB7C4C6018456A8B7AF7F2BB703FD6865489C
Malicious:	true
Yara Hits:	Rule: SUSP_RANSOMWARE_Indicator_Jul20, Description: Detects ransomware indicator, Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, Author: Florian Roth Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, Author: Joe Security Rule: Gandcrab, Description: Gandcrab Payload, Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, Author: kevoreilly
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This @i...5m cannot be run in DOS mode....$.......AU@..4...4...4..Ce...4..Ce...4...f...4...4...4...L...4...4/.4...f...4...f...4...f...4..Rich.4..................PE..L...].vZ.............................J............@..........................`............@.................................p........@.......................P.......................................................................................text............................... ..`.rdata..............................@....data........ ......................@....CRT.........0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.804368489925485
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9gkAKTWOXp.exe
File size:	75264
MD5:	74e135b472b7496b371ce3ba3acfeea8
SHA1:	b64fdd870ff28291b8347317a838a5fb210a6056
SHA256:	d093322a612760cb00ae6fb4c453851ba26f59f2e6a0920b5871a28bbddf9355
SHA512:	c7c3fc7db77b5d450b857917b4157c2e1d2dcc41e18e248e50139711a04ee9893be26679e969a769113349ef9122387333ec7fe57d4d84dc541a4c9f9e25300b
SSDEEP:	1536:kgSeGDjtQhnwmmB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv:kMSjOnrmBbMqqMmr3IdE8we0Avu5r++N
TLSH:	787317053AE18133FAF2F9B265B869E1587B7E541B287ADF00E8043E19275E25D30B4F
File Content Preview:	MZ......................@...............................................!..L.!This ..^.:_m cannot be run in DOS mode....$.......AU@..4...4...4..Ce...4..Ce...4...f...4...4...4...L...4...4/..4...f...4...f...4...f...4..Rich.4..................PE..L...].vZ...

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x404af0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5A76065D [Sat Feb 3 18:58:37 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	40306b615af659fc1f93cfb121cc38d9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
call 00007F7110ADC4ADh
push 00000000h
call dword ptr [00409168h]
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 5Ch
push esi
push 00000044h
lea eax, dword ptr [ebp-58h]
xorps xmm0, xmm0
push 00000000h
push eax
mov esi, ecx
movdqu dqword ptr [ebp-10h], xmm0
call 00007F7110AE0707h
mov eax, dword ptr [00412B0Ch]
add esp, 0Ch
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-1Ch], eax
mov eax, dword ptr [00412B08h]
or dword ptr [ebp-2Ch], 00000101h
mov dword ptr [ebp-20h], eax
xor eax, eax
mov word ptr [ebp-28h], ax
lea eax, dword ptr [ebp-10h]
push eax
lea eax, dword ptr [ebp-58h]
mov dword ptr [ebp-58h], 00000044h
push eax
push 00000000h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
push 00000000h
push esi
push 00000000h
call dword ptr [00409164h]
test eax, eax
jne 00007F7110ADC70Dh
call dword ptr [00409064h]
pop esi
mov esp, ebp
pop ebp
ret
push dword ptr [ebp-10h]
mov esi, dword ptr [0040910Ch]
call esi
push dword ptr [ebp-0Ch]
call esi
pop esi
mov esp, ebp
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 10h
movq xmm0, qword ptr [0040FF2Ch]
mov al, byte ptr [0040FF34h]
push ebx
mov ebx, dword ptr [ebp+08h]

Rich Headers

Programming Language:

[ C ] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 build 21005

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10970	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15000	0xab0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8000	0x8000	False	0.439727783203125	data	5.762192122939682	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x9000	0x8600	False	0.26437150186567165	data	3.71703192533741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x12000	0x1000	0xc00	False	0.2613932291666667	data	3.15531156836296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x13000	0x1000	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x1000	0x200	False	0.52734375	data	4.710061382693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15000	0x1000	0xc00	False	0.008138020833333334	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x14060	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	SetFilePointer, GetFileAttributesW, ReadFile, GetLastError, MoveFileW, lstrcpyW, SetFileAttributesW, CreateMutexW, GetDriveTypeW, VerSetConditionMask, WaitForSingleObject, GetTickCount, InitializeCriticalSection, OpenProcess, GetSystemDirectoryW, TerminateThread, Sleep, TerminateProcess, VerifyVersionInfoW, WaitForMultipleObjects, DeleteCriticalSection, ExpandEnvironmentStringsW, lstrlenW, SetHandleInformation, lstrcatA, MultiByteToWideChar, CreatePipe, lstrcmpiA, Process32NextW, CreateToolhelp32Snapshot, LeaveCriticalSection, EnterCriticalSection, FindFirstFileW, lstrcmpW, FindClose, FindNextFileW, GetNativeSystemInfo, GetComputerNameW, GetDiskFreeSpaceW, GetWindowsDirectoryW, GetVolumeInformationW, LoadLibraryA, lstrcmpiW, VirtualFree, CreateThread, CloseHandle, lstrcatW, CreateFileMappingW, ExitThread, CreateFileW, GetModuleFileNameW, WriteFile, GetModuleHandleW, UnmapViewOfFile, MapViewOfFile, GetFileSize, GetEnvironmentVariableW, lstrcpyA, GetModuleHandleA, VirtualAlloc, Process32FirstW, GetTempPathW, GetProcAddress, GetProcessHeap, HeapFree, HeapAlloc, lstrlenA, CreateProcessW, ExitProcess, IsProcessorFeaturePresent
USER32.dll	wsprintfW, TranslateMessage, RegisterClassExW, LoadIconW, SetWindowLongW, EndPaint, BeginPaint, LoadCursorW, GetMessageW, ShowWindow, CreateWindowExW, SendMessageW, DispatchMessageW, DefWindowProcW, UpdateWindow, GetForegroundWindow, DestroyWindow
GDI32.dll	TextOutW
ADVAPI32.dll	CryptExportKey, AllocateAndInitializeSid, RegSetValueExW, RegCreateKeyExW, RegCloseKey, CryptAcquireContextW, CryptGetKeyParam, CryptReleaseContext, CryptImportKey, CryptEncrypt, CryptGenKey, CryptDestroyKey, GetUserNameW, RegQueryValueExW, RegOpenKeyExW, FreeSid
SHELL32.dll	SHGetSpecialFolderPathW, ShellExecuteExW, ShellExecuteW
CRYPT32.dll	CryptStringToBinaryA, CryptBinaryToStringA
WININET.dll	InternetCloseHandle, HttpAddRequestHeadersW, HttpSendRequestW, InternetConnectW, HttpOpenRequestW, InternetOpenW, InternetReadFile
PSAPI.DLL	EnumDeviceDrivers, GetDeviceDriverBaseNameW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.38.8.8.855642532829498 09/01/22-00:01:41.321667	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55642	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860090532829500 09/01/22-00:02:16.489371	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60090	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862436532026737 09/01/22-00:02:57.542714	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62436	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855955532829500 09/01/22-00:03:25.632008	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	55955	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853431532829498 09/01/22-00:02:18.409896	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53431	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865513532829500 09/01/22-00:02:19.430995	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65513	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864276532829498 09/01/22-00:03:00.100399	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64276	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851891532026737 09/01/22-00:03:31.975246	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51891	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859765532026737 09/01/22-00:03:34.032990	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59765	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853309532829500 09/01/22-00:01:54.918396	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53309	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854155532829498 09/01/22-00:02:39.711366	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54155	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849169532829500 09/01/22-00:02:32.443414	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49169	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864378532829500 09/01/22-00:03:19.972139	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64378	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857391532829500 09/01/22-00:02:53.276938	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57391	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851597532026737 09/01/22-00:03:26.976848	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51597	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853271532829498 09/01/22-00:02:55.260307	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53271	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853471532829500 09/01/22-00:02:00.665796	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53471	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865323532026737 09/01/22-00:01:43.859132	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65323	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860647532829498 09/01/22-00:03:25.300157	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60647	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850230532026737 09/01/22-00:02:54.735839	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50230	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850624532026737 09/01/22-00:03:18.677171	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50624	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853468532829500 09/01/22-00:02:00.604247	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53468	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858122532829498 09/01/22-00:02:27.905128	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	58122	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854436532829498 09/01/22-00:03:36.045306	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54436	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862426532026737 09/01/22-00:03:13.145963	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62426	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856046532829500 09/01/22-00:01:38.500367	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	56046	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859378532829500 09/01/22-00:02:48.340518	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59378	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858305532026737 09/01/22-00:02:34.497221	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	58305	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861418532829498 09/01/22-00:02:02.984507	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61418	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850095532026737 09/01/22-00:03:38.741458	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50095	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852114532026737 09/01/22-00:03:20.324395	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52114	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865466532829500 09/01/22-00:03:37.373699	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65466	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853042532026737 09/01/22-00:03:06.339869	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53042	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849877532829500 09/01/22-00:02:36.035379	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49877	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864971532829500 09/01/22-00:03:05.617213	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64971	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861186532829498 09/01/22-00:02:52.648140	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61186	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859829532829500 09/01/22-00:02:55.953112	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59829	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849204532026737 09/01/22-00:02:46.678054	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	49204	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861364532829498 09/01/22-00:03:28.558638	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61364	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857829532829500 09/01/22-00:03:23.021549	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57829	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850788532026737 09/01/22-00:02:43.387386	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50788	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851996532026737 09/01/22-00:02:26.312895	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51996	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857706532829500 09/01/22-00:01:42.686131	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57706	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859436532026737 09/01/22-00:01:57.638087	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59436	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859822532026737 09/01/22-00:02:19.952319	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59822	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860587532026737 09/01/22-00:01:27.550732	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	60587	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852957532829500 09/01/22-00:01:25.328522	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	52957	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858914532829500 09/01/22-00:03:18.020601	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58914	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853850532026737 09/01/22-00:01:50.247028	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53850	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856619532026737 09/01/22-00:02:49.126045	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	56619	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852112532026737 09/01/22-00:03:20.284135	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52112	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865198532829500 09/01/22-00:02:04.768621	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65198	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853848532829498 09/01/22-00:01:59.462827	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53848	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851893532026737 09/01/22-00:03:32.036713	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51893	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854433532829498 09/01/22-00:03:35.979601	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54433	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853310532829500 09/01/22-00:01:54.940366	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53310	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859438532026737 09/01/22-00:01:57.681285	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59438	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861421532829498 09/01/22-00:02:03.043258	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61421	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852458532026737 09/01/22-00:03:02.844406	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52458	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855652532829498 09/01/22-00:03:19.259211	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55652	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861130532829498 09/01/22-00:03:15.942186	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61130	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860421532829498 09/01/22-00:03:32.382333	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60421	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864973532829500 09/01/22-00:03:05.661525	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64973	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863567532026737 09/01/22-00:02:17.089606	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	63567	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865463532829500 09/01/22-00:03:37.309587	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65463	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865389532026737 09/01/22-00:02:38.719558	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65389	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853040532026737 09/01/22-00:03:06.300781	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53040	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857827532829500 09/01/22-00:03:22.978908	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57827	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853039532026737 09/01/22-00:03:06.280270	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53039	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859585532026737 09/01/22-00:02:11.746820	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59585	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857708532829500 09/01/22-00:01:42.729663	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57708	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851142532829498 09/01/22-00:01:24.090037	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	51142	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853433532829498 09/01/22-00:02:18.458138	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53433	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860093532829500 09/01/22-00:02:16.558554	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60093	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849206532026737 09/01/22-00:02:46.717208	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	49206	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851143532829498 09/01/22-00:01:24.124615	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	51143	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854158532829498 09/01/22-00:02:39.772185	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54158	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859376532829500 09/01/22-00:02:48.263272	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59376	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864825532829500 09/01/22-00:02:24.749273	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64825	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864273532829498 09/01/22-00:03:00.036817	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64273	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851894532026737 09/01/22-00:03:32.055555	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51894	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854434532829498 09/01/22-00:03:36.001169	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54434	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859768532026737 09/01/22-00:03:34.095324	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59768	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853054532829498 09/01/22-00:02:15.078816	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53054	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863448532829498 09/01/22-00:02:35.455212	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63448	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865111532829500 09/01/22-00:01:46.954181	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65111	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853627532026737 09/01/22-00:02:01.832804	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53627	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865200532829500 09/01/22-00:02:04.820486	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65200	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855461532829498 09/01/22-00:03:07.325312	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55461	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865390532026737 09/01/22-00:02:38.738598	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65390	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865516532829500 09/01/22-00:02:19.492210	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65516	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855654532829498 09/01/22-00:03:19.297074	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55654	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854288532829500 09/01/22-00:03:33.756470	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	54288	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865515532829500 09/01/22-00:02:19.472414	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65515	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859767532026737 09/01/22-00:03:34.075907	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59767	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860649532829498 09/01/22-00:03:25.341169	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60649	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853628532026737 09/01/22-00:02:01.851234	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53628	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864970532829500 09/01/22-00:02:44.867082	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64970	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862434532026737 09/01/22-00:02:57.492445	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62434	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859583532026737 09/01/22-00:02:11.706174	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59583	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850232532026737 09/01/22-00:02:54.777871	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50232	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852959532829500 09/01/22-00:01:25.367458	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	52959	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850787532026737 09/01/22-00:02:43.367194	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50787	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858123532829498 09/01/22-00:02:27.969558	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	58123	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860423532829498 09/01/22-00:03:32.424188	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60423	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865201532829500 09/01/22-00:02:04.842170	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65201	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854157532829498 09/01/22-00:02:39.751533	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54157	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865112532829500 09/01/22-00:01:46.974641	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65112	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859830532829500 09/01/22-00:02:55.974495	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59830	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855460532829498 09/01/22-00:03:07.301197	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55460	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853307532829500 09/01/22-00:01:54.875889	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53307	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851595532026737 09/01/22-00:03:26.929732	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51595	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856044532829500 09/01/22-00:01:38.460693	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	56044	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857828532829500 09/01/22-00:03:23.000023	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57828	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864606532829500 09/01/22-00:02:41.903320	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64606	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853273532829498 09/01/22-00:02:55.304130	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53273	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856047532829500 09/01/22-00:01:38.529181	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	56047	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850626532026737 09/01/22-00:03:18.717464	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50626	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863691532829498 09/01/22-00:03:21.687512	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63691	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859825532026737 09/01/22-00:02:20.014612	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59825	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855954532829500 09/01/22-00:03:25.612012	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	55954	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862428532026737 09/01/22-00:03:13.188986	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62428	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861419532829498 09/01/22-00:02:03.004767	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61419	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860474532829498 09/01/22-00:02:47.119975	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60474	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864274532829498 09/01/22-00:03:00.057400	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64274	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853853532026737 09/01/22-00:01:50.543832	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53853	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855248532829498 09/01/22-00:03:03.486266	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55248	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853432532829498 09/01/22-00:02:18.428585	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53432	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853849532829498 09/01/22-00:01:59.483040	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53849	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859586532026737 09/01/22-00:02:11.767488	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59586	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860477532829498 09/01/22-00:02:47.180255	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60477	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852743532026737 09/01/22-00:03:23.998658	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52743	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849170532829500 09/01/22-00:02:32.467435	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49170	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865325532026737 09/01/22-00:01:43.903174	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65325	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857575532829498 09/01/22-00:01:53.271847	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57575	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849879532829500 09/01/22-00:02:36.072251	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49879	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859640532026737 09/01/22-00:01:39.971866	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59640	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865109532829500 09/01/22-00:01:46.914019	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65109	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863450532829498 09/01/22-00:02:35.496675	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63450	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860646532829498 09/01/22-00:03:25.281760	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60646	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854285532829500 09/01/22-00:03:33.695070	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	54285	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858915532829500 09/01/22-00:03:18.040653	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58915	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864974532829500 09/01/22-00:03:05.683602	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64974	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858482532829500 09/01/22-00:03:29.362481	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58482	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864125532829498 09/01/22-00:02:44.347197	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64125	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859437532026737 09/01/22-00:01:57.658266	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59437	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857137532829498 09/01/22-00:01:34.192981	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57137	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860819532829500 09/01/22-00:03:08.807703	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60819	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864598532829498 09/01/22-00:02:22.069673	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64598	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865388532026737 09/01/22-00:02:38.683294	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65388	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852460532026737 09/01/22-00:03:02.922606	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52460	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861361532829498 09/01/22-00:03:28.363595	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61361	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865464532829500 09/01/22-00:03:37.331573	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65464	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863566532026737 09/01/22-00:02:17.069143	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	63566	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849203532026737 09/01/22-00:02:46.656883	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	49203	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864972532829500 09/01/22-00:03:05.639386	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64972	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853051532829498 09/01/22-00:02:15.015452	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53051	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851995532026737 09/01/22-00:02:26.294405	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51995	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851107532829500 09/01/22-00:03:01.623107	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	51107	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864969532829500 09/01/22-00:02:44.846895	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64969	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852113532026737 09/01/22-00:03:20.304409	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52113	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858121532829498 09/01/22-00:02:27.883460	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	58121	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857707532829500 09/01/22-00:01:42.707644	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57707	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861420532829498 09/01/22-00:02:03.023139	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61420	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860772532829498 09/01/22-00:01:45.515640	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60772	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859379532829500 09/01/22-00:02:48.360270	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59379	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860420532829498 09/01/22-00:03:32.361100	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60420	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858306532026737 09/01/22-00:02:34.518930	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	58306	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857136532829498 09/01/22-00:01:34.170593	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57136	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863692532829498 09/01/22-00:03:21.709351	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63692	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851110532829500 09/01/22-00:03:01.687030	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	51110	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855651532829498 09/01/22-00:03:19.239137	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55651	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861187532829498 09/01/22-00:02:52.669551	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61187	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850789532026737 09/01/22-00:02:43.405655	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50789	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864126532829498 09/01/22-00:02:44.367092	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64126	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856045532829500 09/01/22-00:01:38.479108	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	56045	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849876532829500 09/01/22-00:02:36.017097	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49876	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853430532829498 09/01/22-00:02:18.389778	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53430	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864275532829498 09/01/22-00:03:00.076893	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64275	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852746532026737 09/01/22-00:03:24.060420	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52746	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865199532829500 09/01/22-00:02:04.790776	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65199	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855643532829498 09/01/22-00:01:41.349610	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55643	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865322532026737 09/01/22-00:01:43.838373	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65322	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857389532829500 09/01/22-00:02:53.228134	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57389	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852457532026737 09/01/22-00:03:02.822494	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52457	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859766532026737 09/01/22-00:03:34.053456	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59766	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850094532026737 09/01/22-00:03:38.722516	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50094	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863689532829498 09/01/22-00:03:21.642301	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63689	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864828532829500 09/01/22-00:02:24.814616	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64828	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862427532026737 09/01/22-00:03:13.168037	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62427	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858485532829500 09/01/22-00:03:30.012594	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58485	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860586532026737 09/01/22-00:01:27.526553	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	60586	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860648532829498 09/01/22-00:03:25.320562	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60648	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850231532026737 09/01/22-00:02:54.755739	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50231	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859831532829500 09/01/22-00:02:55.995864	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59831	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857138532829498 09/01/22-00:01:34.214783	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57138	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865465532829500 09/01/22-00:03:37.351949	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65465	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859641532026737 09/01/22-00:01:39.990388	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59641	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859638532026737 09/01/22-00:01:39.931325	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59638	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854435532829498 09/01/22-00:03:36.023381	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54435	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860818532829500 09/01/22-00:03:08.745097	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60818	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857576532829498 09/01/22-00:01:53.290249	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57576	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849171532829500 09/01/22-00:02:32.489443	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49171	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851144532829498 09/01/22-00:01:24.145242	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	51144	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852115532026737 09/01/22-00:03:20.348262	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52115	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856620532026737 09/01/22-00:02:49.146584	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	56620	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851109532829500 09/01/22-00:03:01.665772	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	51109	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864379532829500 09/01/22-00:03:19.992460	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64379	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864599532829498 09/01/22-00:02:22.089885	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64599	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860821532829500 09/01/22-00:03:08.846909	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60821	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849205532026737 09/01/22-00:02:46.696702	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	49205	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849878532829500 09/01/22-00:02:36.053729	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49878	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853846532829498 09/01/22-00:01:59.423880	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53846	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860091532829500 09/01/22-00:02:16.509694	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60091	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859377532829500 09/01/22-00:02:48.283085	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59377	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859824532026737 09/01/22-00:02:19.994370	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59824	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864607532829500 09/01/22-00:02:41.921899	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64607	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855249532829498 09/01/22-00:03:03.506251	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55249	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864380532829500 09/01/22-00:03:20.011368	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64380	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850092532026737 09/01/22-00:03:38.678470	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50092	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853272532829498 09/01/22-00:02:55.282821	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53272	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857392532829500 09/01/22-00:02:53.296910	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57392	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858916532829500 09/01/22-00:03:18.060823	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58916	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853053532829498 09/01/22-00:02:15.057233	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53053	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864826532829500 09/01/22-00:02:24.770961	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64826	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853625532026737 09/01/22-00:02:01.788642	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53625	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851596532026737 09/01/22-00:03:26.954769	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51596	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862435532026737 09/01/22-00:02:57.512287	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62435	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853852532026737 09/01/22-00:01:50.489647	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53852	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862429532026737 09/01/22-00:03:13.209944	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62429	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860584532026737 09/01/22-00:01:27.482735	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	60584	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864124532829498 09/01/22-00:02:44.327136	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64124	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861189532829498 09/01/22-00:02:52.764321	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61189	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.849168532829500 09/01/22-00:02:32.423642	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	49168	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863451532829498 09/01/22-00:02:35.516825	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63451	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850625532026737 09/01/22-00:03:18.697259	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50625	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854286532829500 09/01/22-00:03:33.715891	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	54286	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860769532829498 09/01/22-00:01:45.451637	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60769	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852744532026737 09/01/22-00:03:24.019183	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52744	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855641532829498 09/01/22-00:01:41.302395	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55641	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853469532829500 09/01/22-00:02:00.624524	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53469	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860770532829498 09/01/22-00:01:45.473540	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60770	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853470532829500 09/01/22-00:02:00.646017	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53470	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865324532026737 09/01/22-00:01:43.883100	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65324	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853851532026737 09/01/22-00:01:50.267332	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53851	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862433532026737 09/01/22-00:02:57.467935	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	62433	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859584532026737 09/01/22-00:02:11.726579	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59584	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860475532829498 09/01/22-00:02:47.139274	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60475	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864123532829498 09/01/22-00:02:44.306860	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64123	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858483532829500 09/01/22-00:03:29.383909	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58483	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856618532026737 09/01/22-00:02:49.105935	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	56618	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855247532829498 09/01/22-00:03:03.466197	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55247	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861362532829498 09/01/22-00:03:28.520063	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61362	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861129532829498 09/01/22-00:03:15.922110	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61129	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857574532829498 09/01/22-00:01:53.251460	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57574	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864597532829498 09/01/22-00:02:22.051454	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64597	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858303532026737 09/01/22-00:02:34.435886	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	58303	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865387532026737 09/01/22-00:02:38.660218	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	65387	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853274532829498 09/01/22-00:02:55.325848	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53274	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851594532026737 09/01/22-00:03:26.907030	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51594	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863565532026737 09/01/22-00:02:17.049623	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	63565	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850627532026737 09/01/22-00:03:18.737468	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50627	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858124532829498 09/01/22-00:02:27.993076	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	58124	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850786532026737 09/01/22-00:02:43.346779	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50786	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850233532026737 09/01/22-00:02:54.805593	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50233	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854287532829500 09/01/22-00:03:33.736226	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	54287	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864605532829500 09/01/22-00:02:41.882665	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64605	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864604532829500 09/01/22-00:02:41.862105	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64604	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855246532829498 09/01/22-00:03:03.448041	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55246	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855953532829500 09/01/22-00:03:25.594151	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	55953	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858484532829500 09/01/22-00:03:29.402067	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58484	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857139532829498 09/01/22-00:01:34.235761	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57139	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859435532026737 09/01/22-00:01:57.617695	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59435	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863564532026737 09/01/22-00:02:17.026690	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	63564	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852958532829500 09/01/22-00:01:25.347118	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	52958	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860092532829500 09/01/22-00:02:16.532570	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60092	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863690532829498 09/01/22-00:03:21.664385	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63690	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858304532026737 09/01/22-00:02:34.463044	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	58304	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855459532829498 09/01/22-00:03:07.276022	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55459	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860476532829498 09/01/22-00:02:47.160135	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60476	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865110532829500 09/01/22-00:01:46.934130	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65110	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.863449532829498 09/01/22-00:02:35.476503	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	63449	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852960532829500 09/01/22-00:01:25.385522	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	52960	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857390532829500 09/01/22-00:02:53.250639	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57390	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857573532829498 09/01/22-00:01:53.226527	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	57573	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.865514532829500 09/01/22-00:02:19.450712	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	65514	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861131532829498 09/01/22-00:03:15.960645	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61131	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851141532829498 09/01/22-00:01:24.068248	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	51141	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853052532829498 09/01/22-00:02:15.036327	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53052	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861128532829498 09/01/22-00:03:15.903464	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61128	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852745532026737 09/01/22-00:03:24.040007	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52745	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.854156532829498 09/01/22-00:02:39.730598	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	54156	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857709532829500 09/01/22-00:01:42.750967	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57709	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861363532829498 09/01/22-00:03:28.538480	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61363	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853308532829500 09/01/22-00:01:54.898418	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	53308	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860585532026737 09/01/22-00:01:27.503002	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	60585	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860771532829498 09/01/22-00:01:45.495695	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60771	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860422532829498 09/01/22-00:03:32.403375	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	60422	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.850093532026737 09/01/22-00:03:38.699985	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	50093	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853041532026737 09/01/22-00:03:06.319112	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53041	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851994532026737 09/01/22-00:02:26.273853	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51994	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858917532829500 09/01/22-00:03:18.082512	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	58917	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864827532829500 09/01/22-00:02:24.792802	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64827	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860820532829500 09/01/22-00:03:08.828384	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	60820	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851997532026737 09/01/22-00:02:26.333413	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51997	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.861188532829498 09/01/22-00:02:52.691629	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	61188	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859832532829500 09/01/22-00:02:56.017085	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	59832	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864600532829498 09/01/22-00:02:22.108885	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	64600	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855640532829498 09/01/22-00:01:41.280696	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55640	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855462532829498 09/01/22-00:03:07.346617	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55462	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859639532026737 09/01/22-00:01:39.951734	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59639	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855653532829498 09/01/22-00:03:19.277165	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	55653	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857826532829500 09/01/22-00:03:22.956962	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	57826	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853847532829498 09/01/22-00:01:59.444336	UDP	2829498	ETPRO TROJAN GandCrab DNS Lookup 1	53847	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851108532829500 09/01/22-00:03:01.644612	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	51108	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.852459532026737 09/01/22-00:03:02.900983	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	52459	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864381532829500 09/01/22-00:03:20.034172	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	64381	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853626532026737 09/01/22-00:02:01.814516	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	53626	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.859823532026737 09/01/22-00:02:19.973756	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	59823	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.851892532026737 09/01/22-00:03:31.996527	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	51892	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856621532026737 09/01/22-00:02:49.211680	UDP	2026737	ET TROJAN Observed GandCrab Domain (gandcrab .bit)	56621	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855956532829500 09/01/22-00:03:25.650230	UDP	2829500	ETPRO TROJAN GandCrab DNS Lookup 3	55956	53	192.168.2.3	8.8.8.8

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2022 00:01:23.064902067 CEST	53975	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:23.084820032 CEST	53	53975	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:23.994477034 CEST	51139	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:24.030497074 CEST	53	51139	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:24.049179077 CEST	51140	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:24.067482948 CEST	53	51140	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:24.068248034 CEST	51141	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:24.088715076 CEST	53	51141	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:24.090037107 CEST	51142	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:24.110754013 CEST	53	51142	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:24.124614954 CEST	51143	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:24.144764900 CEST	53	51143	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:24.145241976 CEST	51144	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:24.164725065 CEST	53	51144	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:25.247797012 CEST	52955	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:25.283262014 CEST	53	52955	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:25.310718060 CEST	52956	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:25.327796936 CEST	53	52956	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:25.328521967 CEST	52957	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:25.346643925 CEST	53	52957	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:25.347117901 CEST	52958	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:25.366964102 CEST	53	52958	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:25.367458105 CEST	52959	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:25.385024071 CEST	53	52959	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:25.385521889 CEST	52960	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:25.405503035 CEST	53	52960	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:26.844472885 CEST	60582	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:27.449457884 CEST	53	60582	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:27.464441061 CEST	60583	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:27.481861115 CEST	53	60583	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:27.482734919 CEST	60584	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:27.502418995 CEST	53	60584	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:27.503001928 CEST	60585	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:27.520689964 CEST	53	60585	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:27.526552916 CEST	60586	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:27.550129890 CEST	53	60586	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:27.550731897 CEST	60587	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:27.573137045 CEST	53	60587	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:33.534245014 CEST	57134	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:34.108952045 CEST	53	57134	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:34.150069952 CEST	57135	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:34.169861078 CEST	53	57135	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:34.170593023 CEST	57136	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:34.192428112 CEST	53	57136	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:34.192981005 CEST	57137	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:34.214257956 CEST	53	57137	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:34.214782953 CEST	57138	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:34.234899998 CEST	53	57138	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:34.235760927 CEST	57139	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:34.256675959 CEST	53	57139	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:35.764401913 CEST	62050	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:36.800379992 CEST	62050	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:37.845704079 CEST	62050	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:38.424983025 CEST	53	62050	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:38.440474033 CEST	56043	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:38.459913969 CEST	53	56043	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:38.460692883 CEST	56044	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:38.478588104 CEST	53	56044	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:38.479108095 CEST	56045	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:38.499536037 CEST	53	56045	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:38.500366926 CEST	56046	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:38.522388935 CEST	53	56046	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:38.529181004 CEST	56047	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:38.547306061 CEST	53	56047	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:39.520437956 CEST	53	62050	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:39.759217024 CEST	59636	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:39.869720936 CEST	53	59636	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:39.895581007 CEST	59637	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:39.914973974 CEST	53	59637	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:39.931324959 CEST	59638	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:39.951137066 CEST	53	59638	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:39.951734066 CEST	59639	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:39.971240997 CEST	53	59639	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:39.971865892 CEST	59640	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:39.989907026 CEST	53	59640	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:39.990387917 CEST	59641	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:40.010957003 CEST	53	59641	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:40.783550978 CEST	53	62050	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:41.157733917 CEST	55638	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:41.194181919 CEST	53	55638	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:41.261158943 CEST	55639	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:41.280056000 CEST	53	55639	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:41.280695915 CEST	55640	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:41.300605059 CEST	53	55640	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:41.302395105 CEST	55641	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:41.320178032 CEST	53	55641	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:41.321666956 CEST	55642	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:41.341320992 CEST	53	55642	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:41.349610090 CEST	55643	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:41.369268894 CEST	53	55643	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:42.602513075 CEST	57704	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:42.639774084 CEST	53	57704	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:42.666846037 CEST	57705	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:42.685431004 CEST	53	57705	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:42.686131001 CEST	57706	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:42.707127094 CEST	53	57706	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:42.707643986 CEST	57707	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:42.729058981 CEST	53	57707	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:42.729662895 CEST	57708	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:42.750449896 CEST	53	57708	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:42.750967026 CEST	57709	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:42.771682978 CEST	53	57709	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:43.750798941 CEST	65320	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:43.786712885 CEST	53	65320	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:43.818617105 CEST	65321	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:43.837654114 CEST	53	65321	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:43.838372946 CEST	65322	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:43.857835054 CEST	53	65322	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:43.859132051 CEST	65323	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:43.878863096 CEST	53	65323	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:43.883100033 CEST	65324	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:43.902585030 CEST	53	65324	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:43.903173923 CEST	65325	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:43.922862053 CEST	53	65325	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:44.873297930 CEST	60767	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:45.412717104 CEST	53	60767	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:45.432225943 CEST	60768	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:45.450937986 CEST	53	60768	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:45.451637030 CEST	60769	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:45.472791910 CEST	53	60769	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:45.473540068 CEST	60770	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:45.495043039 CEST	53	60770	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:45.495695114 CEST	60771	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:45.514930964 CEST	53	60771	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:45.515640020 CEST	60772	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:45.535151958 CEST	53	60772	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:46.825660944 CEST	65107	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:46.863656044 CEST	53	65107	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:46.895714045 CEST	65108	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:46.913108110 CEST	53	65108	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:46.914019108 CEST	65109	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:46.933680058 CEST	53	65109	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:46.934129953 CEST	65110	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:46.953710079 CEST	53	65110	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:46.954180956 CEST	65111	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:46.973721981 CEST	53	65111	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:46.974641085 CEST	65112	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:46.994463921 CEST	53	65112	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:47.966227055 CEST	53848	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:48.969243050 CEST	53848	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:50.027492046 CEST	53848	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:50.163376093 CEST	53	53848	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:50.193775892 CEST	53849	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:50.211262941 CEST	53	53849	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:50.247028112 CEST	53850	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:50.265369892 CEST	53	53850	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:50.267332077 CEST	53851	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:50.285290956 CEST	53	53851	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:50.489646912 CEST	53852	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:50.507364035 CEST	53	53852	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:50.543832064 CEST	53853	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:50.561597109 CEST	53	53853	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:50.793282986 CEST	53	53848	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:52.259315968 CEST	53	53848	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:52.586035013 CEST	57571	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:53.162805080 CEST	53	57571	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:53.206665039 CEST	57572	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:53.225925922 CEST	53	57572	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:53.226526976 CEST	57573	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:53.246345043 CEST	53	57573	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:53.251460075 CEST	57574	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:53.271325111 CEST	53	57574	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:53.271847010 CEST	57575	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:53.289664030 CEST	53	57575	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:53.290249109 CEST	57576	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:53.310367107 CEST	53	57576	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:54.258793116 CEST	53305	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:54.812717915 CEST	53	53305	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:54.856652975 CEST	53306	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:54.875181913 CEST	53	53306	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:54.875889063 CEST	53307	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:54.897751093 CEST	53	53307	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:54.898417950 CEST	53308	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:54.917856932 CEST	53	53308	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:54.918395996 CEST	53309	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:54.939847946 CEST	53	53309	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:54.940366030 CEST	53310	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:54.961664915 CEST	53	53310	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:55.904305935 CEST	59433	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:56.898372889 CEST	59433	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:57.544912100 CEST	53	59433	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:57.597537994 CEST	59434	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:57.616928101 CEST	53	59434	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:57.617695093 CEST	59435	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:57.637340069 CEST	53	59435	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:57.638087034 CEST	59436	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:57.657670021 CEST	53	59436	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:57.658266068 CEST	59437	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:57.680296898 CEST	53	59437	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:57.681284904 CEST	59438	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:57.700737000 CEST	53	59438	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:58.788856030 CEST	53844	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:59.361457109 CEST	53	53844	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:59.402009010 CEST	53845	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:59.421237946 CEST	53	53845	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:59.423880100 CEST	53846	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:59.443866014 CEST	53	53846	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:59.444335938 CEST	53847	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:59.462193966 CEST	53	53847	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:59.462826967 CEST	53848	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:59.482578039 CEST	53	53848	8.8.8.8	192.168.2.3
Sep 1, 2022 00:01:59.483040094 CEST	53849	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:01:59.500787973 CEST	53	53849	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:00.502871990 CEST	53466	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:00.540338039 CEST	53	53466	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:00.582490921 CEST	53467	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:00.602976084 CEST	53	53467	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:00.604247093 CEST	53468	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:00.623477936 CEST	53	53468	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:00.624524117 CEST	53469	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:00.645464897 CEST	53	53469	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:00.646017075 CEST	53470	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:00.665227890 CEST	53	53470	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:00.665796041 CEST	53471	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:00.686867952 CEST	53	53471	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:01.677488089 CEST	53623	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:01.711468935 CEST	53	53623	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:01.768798113 CEST	53624	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:01.787820101 CEST	53	53624	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:01.788641930 CEST	53625	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:01.813957930 CEST	53	53625	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:01.814516068 CEST	53626	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:01.832298040 CEST	53	53626	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:01.832803965 CEST	53627	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:01.850697994 CEST	53	53627	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:01.851233959 CEST	53628	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:01.870028019 CEST	53	53628	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:01.915724039 CEST	53	59433	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:02.841990948 CEST	61416	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:02.924088001 CEST	53	61416	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:02.966444016 CEST	61417	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:02.983864069 CEST	53	61417	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:02.984507084 CEST	61418	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:03.004199028 CEST	53	61418	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:03.004766941 CEST	61419	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:03.022608995 CEST	53	61419	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:03.023139000 CEST	61420	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:03.041289091 CEST	53	61420	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:03.043257952 CEST	61421	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:03.060731888 CEST	53	61421	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:04.111052990 CEST	65196	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:04.694045067 CEST	53	65196	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:04.748806953 CEST	65197	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:04.767615080 CEST	53	65197	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:04.768620968 CEST	65198	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:04.790055037 CEST	53	65198	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:04.790776014 CEST	65199	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:04.812170982 CEST	53	65199	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:04.820486069 CEST	65200	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:04.841615915 CEST	53	65200	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:04.842170000 CEST	65201	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:04.861390114 CEST	53	65201	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:05.931890965 CEST	58708	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:06.949732065 CEST	58708	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:07.982110023 CEST	58708	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:10.088450909 CEST	58708	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:10.950472116 CEST	53	58708	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:11.685623884 CEST	59582	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:11.704813957 CEST	53	59582	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:11.706173897 CEST	59583	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:11.725864887 CEST	53	59583	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:11.726578951 CEST	59584	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:11.746112108 CEST	53	59584	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:11.746819973 CEST	59585	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:11.766913891 CEST	53	59585	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:11.767488003 CEST	59586	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:11.787333965 CEST	53	59586	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:11.967653036 CEST	53	58708	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:12.846661091 CEST	53049	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:12.999161005 CEST	53	58708	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:13.892630100 CEST	53049	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:14.387511015 CEST	53	58708	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:14.908216953 CEST	53049	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:14.971482038 CEST	53	53049	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:14.995146036 CEST	53050	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:15.014755964 CEST	53	53050	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:15.015451908 CEST	53051	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:15.035367012 CEST	53	53051	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:15.036326885 CEST	53052	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:15.056536913 CEST	53	53052	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:15.057233095 CEST	53053	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:15.078147888 CEST	53	53053	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:15.078815937 CEST	53054	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:15.099627018 CEST	53	53054	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:15.420219898 CEST	60088	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.408524990 CEST	60088	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.448688984 CEST	53	60088	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:16.468611002 CEST	60089	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.488795042 CEST	53	60089	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:16.489371061 CEST	60090	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.509176016 CEST	53	60090	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:16.509694099 CEST	60091	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.530898094 CEST	53	60091	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:16.532569885 CEST	60092	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.553879023 CEST	53	60092	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:16.558553934 CEST	60093	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.580022097 CEST	53	60093	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:16.953728914 CEST	63562	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:16.991344929 CEST	53	63562	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:17.000292063 CEST	63563	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:17.021205902 CEST	53	63563	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:17.026690006 CEST	63564	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:17.048921108 CEST	53	63564	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:17.049623013 CEST	63565	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:17.068710089 CEST	53	63565	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:17.069143057 CEST	63566	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:17.089041948 CEST	53	63566	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:17.089606047 CEST	63567	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:17.109560966 CEST	53	63567	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:17.505155087 CEST	53	60088	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:17.824410915 CEST	53428	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:18.361676931 CEST	53	53428	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:18.368638039 CEST	53429	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:18.389043093 CEST	53	53429	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:18.389777899 CEST	53430	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:18.408541918 CEST	53	53430	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:18.409895897 CEST	53431	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:18.427966118 CEST	53	53431	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:18.428585052 CEST	53432	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:18.449790001 CEST	53	53432	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:18.458137989 CEST	53433	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:18.479060888 CEST	53	53433	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:18.825237036 CEST	65511	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:18.912440062 CEST	53	53049	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.401741028 CEST	53	65511	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.409481049 CEST	65512	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.430453062 CEST	53	65512	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.430994987 CEST	65513	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.450289965 CEST	53	65513	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.450711966 CEST	65514	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.471883059 CEST	53	65514	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.472414017 CEST	65515	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.491760969 CEST	53	65515	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.492209911 CEST	65516	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.512691975 CEST	53	65516	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.849414110 CEST	59820	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.925700903 CEST	53	59820	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.930727959 CEST	53	53049	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.932447910 CEST	59821	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.951675892 CEST	53	59821	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.952318907 CEST	59822	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.970587015 CEST	53	59822	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.973756075 CEST	59823	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:19.993907928 CEST	53	59823	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:19.994369984 CEST	59824	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:20.013947010 CEST	53	59824	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:20.014611959 CEST	59825	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:20.035240889 CEST	53	59825	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:20.450695992 CEST	64595	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:21.440356970 CEST	64595	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:22.022486925 CEST	53	64595	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:22.031480074 CEST	64596	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:22.050517082 CEST	53	64596	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:22.051454067 CEST	64597	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:22.069267035 CEST	53	64597	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:22.069673061 CEST	64598	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:22.074369907 CEST	53	64595	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:22.089488983 CEST	53	64598	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:22.089884996 CEST	64599	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:22.108500004 CEST	53	64599	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:22.108885050 CEST	64600	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:22.129991055 CEST	53	64600	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:22.575946093 CEST	52079	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:23.581091881 CEST	52079	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:24.596934080 CEST	52079	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:24.712889910 CEST	53	52079	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:24.728225946 CEST	64824	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:24.748702049 CEST	53	64824	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:24.749273062 CEST	64825	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:24.770515919 CEST	53	64825	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:24.770961046 CEST	64826	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:24.792413950 CEST	53	64826	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:24.792802095 CEST	64827	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:24.814188957 CEST	53	64827	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:24.814615965 CEST	64828	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:24.833614111 CEST	53	64828	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:25.179150105 CEST	51992	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.190792084 CEST	51992	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.233566046 CEST	53	51992	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:26.252104998 CEST	51993	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.270071030 CEST	53	51993	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:26.273853064 CEST	51994	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.293915987 CEST	53	51994	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:26.294404984 CEST	51995	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.312290907 CEST	53	51995	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:26.312895060 CEST	51996	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.332462072 CEST	53	51996	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:26.333412886 CEST	51997	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.352917910 CEST	53	51997	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:26.695220947 CEST	58119	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:26.714562893 CEST	53	52079	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:26.841078043 CEST	53	52079	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.386841059 CEST	53	51992	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.750152111 CEST	58119	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:27.784187078 CEST	53	58119	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.817483902 CEST	53	58119	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.858907938 CEST	58120	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:27.877135992 CEST	53	58120	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.883460045 CEST	58121	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:27.904680967 CEST	53	58121	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.905128002 CEST	58122	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:27.926455975 CEST	53	58122	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.969558001 CEST	58123	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:27.989053965 CEST	53	58123	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:27.993076086 CEST	58124	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:28.014046907 CEST	53	58124	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:29.601125002 CEST	49166	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:30.826258898 CEST	53	49166	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:32.371490955 CEST	49166	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:32.404072046 CEST	49167	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:32.422898054 CEST	53	49167	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:32.423641920 CEST	49168	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:32.442924023 CEST	53	49168	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:32.443413973 CEST	49169	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:32.465111017 CEST	53	49169	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:32.467434883 CEST	49170	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:32.486720085 CEST	53	49170	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:32.489443064 CEST	49171	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:32.510637999 CEST	53	49171	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:32.867223024 CEST	58301	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:33.862488031 CEST	58301	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:33.985611916 CEST	53	49166	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.407073975 CEST	53	58301	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.417866945 CEST	58302	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:34.435112000 CEST	53	58302	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.435885906 CEST	58303	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:34.459167957 CEST	53	58303	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.463043928 CEST	58304	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:34.484791994 CEST	53	58304	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.489913940 CEST	53	58301	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.497220993 CEST	58305	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:34.517954111 CEST	53	58305	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.518929958 CEST	58306	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:34.537820101 CEST	53	58306	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:34.851964951 CEST	63446	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:35.427285910 CEST	53	63446	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:35.437273979 CEST	63447	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:35.454541922 CEST	53	63447	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:35.455212116 CEST	63448	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:35.475027084 CEST	53	63448	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:35.476502895 CEST	63449	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:35.496222973 CEST	53	63449	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:35.496675014 CEST	63450	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:35.516345024 CEST	53	63450	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:35.516824961 CEST	63451	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:35.536685944 CEST	53	63451	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:35.859457016 CEST	49874	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:35.984587908 CEST	53	49874	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:35.995635033 CEST	49875	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:36.012811899 CEST	53	49875	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:36.017096996 CEST	49876	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:36.034972906 CEST	53	49876	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:36.035378933 CEST	49877	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:36.053332090 CEST	53	49877	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:36.053729057 CEST	49878	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:36.071810961 CEST	53	49878	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:36.072251081 CEST	49879	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:36.091907978 CEST	53	49879	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:36.459953070 CEST	65459	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:37.472609997 CEST	65459	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:38.497634888 CEST	65459	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:38.631139994 CEST	53	65459	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:38.640486956 CEST	65386	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:38.659338951 CEST	53	65386	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:38.660218000 CEST	65387	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:38.680645943 CEST	53	65387	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:38.683294058 CEST	65388	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:38.701905012 CEST	53	65388	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:38.719558001 CEST	65389	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:38.738066912 CEST	53	65389	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:38.738598108 CEST	65390	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:38.759218931 CEST	53	65390	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.027879000 CEST	53	65459	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.088742971 CEST	54153	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:39.143616915 CEST	53	65459	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.675185919 CEST	53	54153	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.691652060 CEST	54154	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:39.710722923 CEST	53	54154	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.711365938 CEST	54155	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:39.729000092 CEST	53	54155	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.730597973 CEST	54156	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:39.750302076 CEST	53	54156	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.751533031 CEST	54157	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:39.771075010 CEST	53	54157	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:39.772185087 CEST	54158	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:39.791596889 CEST	53	54158	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:40.153419018 CEST	64602	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:41.172076941 CEST	64602	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:41.822036982 CEST	53	64602	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:41.842334986 CEST	64603	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:41.861427069 CEST	53	64603	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:41.862104893 CEST	64604	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:41.881999969 CEST	53	64604	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:41.882664919 CEST	64605	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:41.902828932 CEST	53	64605	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:41.903320074 CEST	64606	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:41.921314955 CEST	53	64606	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:41.921899080 CEST	64607	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:41.941456079 CEST	53	64607	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:42.277318001 CEST	50784	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:42.283397913 CEST	53	64602	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:43.285449982 CEST	50784	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:43.320070028 CEST	53	50784	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:43.328716993 CEST	50785	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:43.345973015 CEST	53	50785	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:43.346779108 CEST	50786	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:43.366689920 CEST	53	50786	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:43.367193937 CEST	50787	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:43.386923075 CEST	53	50787	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:43.387386084 CEST	50788	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:43.405071020 CEST	53	50788	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:43.405654907 CEST	50789	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:43.425419092 CEST	53	50789	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:43.751919985 CEST	64121	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.279233932 CEST	53	64121	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.286156893 CEST	64122	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.305149078 CEST	53	64122	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.306859970 CEST	64123	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.326653957 CEST	53	64123	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.327136040 CEST	64124	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.346456051 CEST	53	64124	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.347197056 CEST	64125	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.366677999 CEST	53	64125	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.367091894 CEST	64126	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.386941910 CEST	53	64126	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.774935961 CEST	64967	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.819075108 CEST	53	64967	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.827179909 CEST	64968	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.846179008 CEST	53	64968	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.846894979 CEST	64969	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.864609003 CEST	53	64969	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.867082119 CEST	64970	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.886693001 CEST	53	64970	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.887150049 CEST	64971	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.908752918 CEST	53	64971	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:44.909322977 CEST	64972	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:44.929284096 CEST	53	64972	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:45.564925909 CEST	60825	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:46.551074982 CEST	60825	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:46.625612020 CEST	53	60825	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:46.632401943 CEST	49202	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:46.652822018 CEST	53	49202	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:46.656883001 CEST	49203	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:46.677609921 CEST	53	49203	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:46.678054094 CEST	49204	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:46.696248055 CEST	53	49204	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:46.696702003 CEST	49205	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:46.716310978 CEST	53	49205	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:46.717207909 CEST	49206	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:46.736613989 CEST	53	49206	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.066291094 CEST	64936	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:47.092792034 CEST	53	64936	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.096024036 CEST	53	60825	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.102243900 CEST	64937	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:47.119285107 CEST	53	64937	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.119975090 CEST	60474	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:47.137702942 CEST	53	60474	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.139273882 CEST	60475	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:47.159663916 CEST	53	60475	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.160135031 CEST	60476	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:47.179497957 CEST	53	60476	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.180254936 CEST	60477	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:47.199672937 CEST	53	60477	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:47.295221090 CEST	53	50784	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:48.143838882 CEST	59374	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:48.169800997 CEST	53	59374	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:48.243660927 CEST	59375	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:48.262660027 CEST	53	59375	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:48.263272047 CEST	59376	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:48.282622099 CEST	53	59376	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:48.283085108 CEST	59377	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:48.302493095 CEST	53	59377	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:48.340517998 CEST	59378	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:48.359857082 CEST	53	59378	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:48.360270023 CEST	59379	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:48.378109932 CEST	53	59379	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:48.992279053 CEST	56616	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:49.030847073 CEST	53	56616	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:49.039655924 CEST	56617	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:49.060447931 CEST	53	56617	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:49.105935097 CEST	56618	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:49.125612974 CEST	53	56618	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:49.126044989 CEST	56619	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:49.145709991 CEST	53	56619	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:49.146584034 CEST	56620	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:49.164716959 CEST	53	56620	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:49.211679935 CEST	56621	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:49.230854988 CEST	53	56621	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:50.544686079 CEST	61184	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:51.666511059 CEST	53	61184	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:52.608259916 CEST	61184	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:52.628920078 CEST	61185	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:52.647394896 CEST	53	61185	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:52.648139954 CEST	61186	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:52.669127941 CEST	53	61186	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:52.669550896 CEST	61187	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:52.691092014 CEST	53	61187	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:52.691628933 CEST	61188	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:52.712511063 CEST	53	61188	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:52.764321089 CEST	61189	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:52.786346912 CEST	53	61189	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.163081884 CEST	57387	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:53.169249058 CEST	53	61184	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.199151039 CEST	53	57387	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.207458973 CEST	57388	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:53.227545977 CEST	53	57388	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.228133917 CEST	57389	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:53.250277996 CEST	53	57389	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.250638962 CEST	57390	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:53.274090052 CEST	53	57390	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.276937962 CEST	57391	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:53.296488047 CEST	53	57391	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.296910048 CEST	57392	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:53.315620899 CEST	53	57392	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:53.660832882 CEST	50228	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:54.678829908 CEST	50228	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:54.707915068 CEST	53	50228	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:54.715509892 CEST	50229	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:54.727380991 CEST	53	50228	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:54.735213995 CEST	53	50229	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:54.735838890 CEST	50230	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:54.755316019 CEST	53	50230	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:54.755738974 CEST	50231	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:54.777358055 CEST	53	50231	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:54.777870893 CEST	50232	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:54.797842026 CEST	53	50232	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:54.805593014 CEST	50233	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:54.826921940 CEST	53	50233	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.193733931 CEST	53269	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.222019911 CEST	53	53269	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.231367111 CEST	53270	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.248954058 CEST	53	53270	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.260307074 CEST	53271	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.282449961 CEST	53	53271	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.282820940 CEST	53272	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.303663969 CEST	53	53272	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.304130077 CEST	53273	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.325366020 CEST	53	53273	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.325848103 CEST	53274	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.344696999 CEST	53	53274	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.844996929 CEST	59827	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.919511080 CEST	53	59827	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.932115078 CEST	59828	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.952475071 CEST	53	59828	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.953111887 CEST	59829	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.974069118 CEST	53	59829	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.974494934 CEST	59830	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:55.995476007 CEST	53	59830	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:55.995863914 CEST	59831	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:56.016655922 CEST	53	59831	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:56.017085075 CEST	59832	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:56.038196087 CEST	53	59832	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:56.404357910 CEST	62431	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:57.411904097 CEST	62431	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:57.439387083 CEST	53	62431	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:57.447629929 CEST	62432	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:57.449079037 CEST	53	62431	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:57.467147112 CEST	53	62432	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:57.467935085 CEST	62433	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:57.488708973 CEST	53	62433	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:57.492444992 CEST	62434	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:57.511897087 CEST	53	62434	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:57.512286901 CEST	62435	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:57.530978918 CEST	53	62435	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:57.542714119 CEST	62436	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:57.561358929 CEST	53	62436	8.8.8.8	192.168.2.3
Sep 1, 2022 00:02:57.924940109 CEST	64271	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:58.928544044 CEST	64271	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:02:59.943011045 CEST	64271	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:00.010236025 CEST	53	64271	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:00.017366886 CEST	64272	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:00.035882950 CEST	53	64272	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:00.036817074 CEST	64273	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:00.057038069 CEST	53	64273	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:00.057399988 CEST	64274	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:00.076392889 CEST	53	64274	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:00.076893091 CEST	64275	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:00.097615957 CEST	53	64275	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:00.100399017 CEST	64276	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:00.121129990 CEST	53	64276	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:00.563648939 CEST	51105	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:01.554763079 CEST	51105	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:01.584554911 CEST	53	51105	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:01.595273972 CEST	53	51105	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:01.601682901 CEST	51106	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:01.622442007 CEST	53	51106	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:01.623106956 CEST	51107	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:01.644107103 CEST	53	51107	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:01.644612074 CEST	51108	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:01.665334940 CEST	53	51108	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:01.665771961 CEST	51109	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:01.686562061 CEST	53	51109	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:01.687030077 CEST	51110	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:01.706001043 CEST	53	51110	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:02.153387070 CEST	52455	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:02.779787064 CEST	53	52455	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:02.801975012 CEST	52456	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:02.821990013 CEST	53	52456	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:02.822494030 CEST	52457	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:02.843368053 CEST	53	52457	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:02.844405890 CEST	52458	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:02.865358114 CEST	53	52458	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:02.900983095 CEST	52459	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:02.922287941 CEST	53	52459	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:02.922605991 CEST	52460	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:02.942126989 CEST	53	52460	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:02.945770025 CEST	53	64271	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:03.343214035 CEST	55244	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:03.418770075 CEST	53	55244	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:03.427838087 CEST	55245	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:03.446106911 CEST	53	55245	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:03.448040962 CEST	55246	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:03.465781927 CEST	53	55246	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:03.466197014 CEST	55247	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:03.485872984 CEST	53	55247	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:03.486265898 CEST	55248	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:03.505850077 CEST	53	55248	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:03.506251097 CEST	55249	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:03.524724007 CEST	53	55249	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:03.962084055 CEST	64969	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:03.967163086 CEST	53	64271	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:04.974921942 CEST	64969	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:05.580583096 CEST	53	64969	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:05.594440937 CEST	64970	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:05.616434097 CEST	53	64970	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:05.617213011 CEST	64971	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:05.638950109 CEST	53	64971	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:05.639385939 CEST	64972	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:05.661201954 CEST	53	64972	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:05.661525011 CEST	64973	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:05.683096886 CEST	53	64973	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:05.683602095 CEST	64974	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:05.704983950 CEST	53	64974	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.090673923 CEST	53	64969	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.123651028 CEST	53037	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:06.253566980 CEST	53	53037	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.260365963 CEST	53038	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:06.279741049 CEST	53	53038	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.280270100 CEST	53039	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:06.300148010 CEST	53	53039	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.300781012 CEST	53040	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:06.318766117 CEST	53	53040	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.319112062 CEST	53041	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:06.339133978 CEST	53	53041	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.339869022 CEST	53042	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:06.360065937 CEST	53	53042	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:06.701911926 CEST	55457	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:07.230133057 CEST	53	55457	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:07.240674019 CEST	55458	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:07.261197090 CEST	53	55458	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:07.276021957 CEST	55459	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:07.297318935 CEST	53	55459	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:07.301197052 CEST	55460	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:07.321963072 CEST	53	55460	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:07.325311899 CEST	55461	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:07.345874071 CEST	53	55461	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:07.346616983 CEST	55462	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:07.367491961 CEST	53	55462	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:08.098186970 CEST	60816	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:08.672029018 CEST	53	60816	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:08.720036983 CEST	60817	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:08.740346909 CEST	53	60817	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:08.745096922 CEST	60818	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:08.766110897 CEST	53	60818	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:08.807703018 CEST	60819	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:08.827946901 CEST	53	60819	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:08.828383923 CEST	60820	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:08.846530914 CEST	53	60820	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:08.846909046 CEST	60821	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:08.866904974 CEST	53	60821	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:11.312613964 CEST	62424	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:11.907406092 CEST	53	62424	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:13.124238968 CEST	62425	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:13.145453930 CEST	53	62425	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:13.145962954 CEST	62426	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:13.167514086 CEST	53	62426	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:13.168036938 CEST	62427	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:13.187902927 CEST	53	62427	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:13.188986063 CEST	62428	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:13.209469080 CEST	53	62428	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:13.209944010 CEST	62429	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:13.232753992 CEST	53	62429	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:13.699589014 CEST	61126	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:14.710131884 CEST	61126	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:15.711199999 CEST	61126	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:15.875538111 CEST	53	61126	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:15.883177996 CEST	61127	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:15.886709929 CEST	53	61126	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:15.902874947 CEST	53	61127	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:15.903464079 CEST	61128	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:15.921664953 CEST	53	61128	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:15.922110081 CEST	61129	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:15.941783905 CEST	53	61129	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:15.942186117 CEST	61130	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:15.960310936 CEST	53	61130	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:15.960644960 CEST	61131	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:15.978528023 CEST	53	61131	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:16.393064976 CEST	55390	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:17.397872925 CEST	55390	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:17.783536911 CEST	53	61126	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:17.989558935 CEST	53	55390	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.001125097 CEST	58913	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.019994974 CEST	53	58913	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.020601034 CEST	58914	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.040131092 CEST	53	58914	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.040652990 CEST	58915	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.060370922 CEST	53	58915	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.060822964 CEST	58916	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.080894947 CEST	53	58916	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.082511902 CEST	58917	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.102590084 CEST	53	58917	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.621407986 CEST	50622	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.650096893 CEST	53	50622	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.657192945 CEST	50623	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.676616907 CEST	53	50623	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.677170992 CEST	50624	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.696774960 CEST	53	50624	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.697258949 CEST	50625	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.717092037 CEST	53	50625	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.717463970 CEST	50626	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.736999989 CEST	53	50626	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:18.737468004 CEST	50627	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:18.754909992 CEST	53	50627	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.167845011 CEST	55649	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.210956097 CEST	53	55649	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.219196081 CEST	55650	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.238610029 CEST	53	55650	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.239136934 CEST	55651	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.258774996 CEST	53	55651	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.259211063 CEST	55652	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.276746988 CEST	53	55652	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.277164936 CEST	55653	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.296673059 CEST	53	55653	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.297074080 CEST	55654	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.316821098 CEST	53	55654	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.696104050 CEST	53	55390	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.834583998 CEST	64376	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.938867092 CEST	53	64376	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.952431917 CEST	64377	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.971436024 CEST	53	64377	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.972138882 CEST	64378	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:19.991856098 CEST	53	64378	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:19.992460012 CEST	64379	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.010216951 CEST	53	64379	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.011368036 CEST	64380	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.031111956 CEST	53	64380	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.034172058 CEST	64381	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.051709890 CEST	53	64381	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.228393078 CEST	52110	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.256568909 CEST	53	52110	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.265758991 CEST	52111	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.283133984 CEST	53	52111	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.284135103 CEST	52112	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.303747892 CEST	53	52112	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.304409027 CEST	52113	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.323898077 CEST	53	52113	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.324394941 CEST	52114	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.344026089 CEST	53	52114	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.348262072 CEST	52115	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:20.366065979 CEST	53	52115	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:20.534615040 CEST	63687	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:21.523137093 CEST	63687	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:21.609051943 CEST	53	63687	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:21.620418072 CEST	63688	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:21.641108990 CEST	53	63688	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:21.642301083 CEST	63689	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:21.663789988 CEST	53	63689	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:21.664385080 CEST	63690	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:21.686964035 CEST	53	63690	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:21.687511921 CEST	63691	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:21.708765030 CEST	53	63691	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:21.709351063 CEST	63692	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:21.729496956 CEST	53	63692	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:21.888966084 CEST	57824	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:22.898207903 CEST	57824	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:22.926181078 CEST	53	57824	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:22.935939074 CEST	57825	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:22.956406116 CEST	53	57825	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:22.956962109 CEST	57826	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:22.978058100 CEST	53	57826	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:22.978908062 CEST	57827	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:22.999502897 CEST	53	57827	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:23.000022888 CEST	57828	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:23.021095037 CEST	53	57828	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:23.021548986 CEST	57829	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:23.042824030 CEST	53	57829	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:23.209656954 CEST	52741	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:23.514621973 CEST	53	57824	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:23.968266010 CEST	53	52741	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:23.980442047 CEST	52742	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:23.997780085 CEST	53	52742	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:23.998657942 CEST	52743	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:24.018424988 CEST	53	52743	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:24.019182920 CEST	52744	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:24.039185047 CEST	53	52744	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:24.040007114 CEST	52745	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:24.059684038 CEST	53	52745	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:24.060420036 CEST	52746	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:24.078253031 CEST	53	52746	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:24.239500046 CEST	60644	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.226500988 CEST	60644	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.255103111 CEST	53	60644	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.263760090 CEST	60645	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.281069994 CEST	53	60645	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.281759977 CEST	60646	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.299524069 CEST	53	60646	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.300157070 CEST	60647	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.319861889 CEST	53	60647	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.320561886 CEST	60648	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.340485096 CEST	53	60648	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.341169119 CEST	60649	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.361062050 CEST	53	60649	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.538189888 CEST	55951	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.566684961 CEST	53	55951	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.576621056 CEST	55952	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.593641996 CEST	53	55952	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.594151020 CEST	55953	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.611632109 CEST	53	55953	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.612011909 CEST	55954	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.631575108 CEST	53	55954	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.632008076 CEST	55955	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.649888039 CEST	53	55955	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.650229931 CEST	55956	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.669991970 CEST	53	55956	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:25.840779066 CEST	51592	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:25.946975946 CEST	53	60644	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.542138100 CEST	53	63687	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.836159945 CEST	51592	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:26.874851942 CEST	53	51592	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.882740974 CEST	51593	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:26.904150963 CEST	53	51593	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.907030106 CEST	51594	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:26.929198980 CEST	53	51594	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.929732084 CEST	51595	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:26.951956987 CEST	53	51595	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.954768896 CEST	51596	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:26.976304054 CEST	53	51596	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.976847887 CEST	51597	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:26.997859001 CEST	53	51597	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:26.998966932 CEST	53	51592	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:27.174635887 CEST	61359	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:28.164587021 CEST	61359	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:28.328942060 CEST	53	61359	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:28.343839884 CEST	61360	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:28.362921000 CEST	53	61360	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:28.363595009 CEST	61361	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:28.383085012 CEST	53	61361	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:28.520062923 CEST	61362	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:28.538108110 CEST	53	61362	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:28.538480043 CEST	61363	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:28.558254004 CEST	53	61363	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:28.558638096 CEST	61364	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:28.578342915 CEST	53	61364	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:28.692234039 CEST	53	61359	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:28.762604952 CEST	58480	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:29.338186979 CEST	53	58480	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:29.344712973 CEST	58481	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:29.362001896 CEST	53	58481	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:29.362481117 CEST	58482	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:29.383466005 CEST	53	58482	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:29.383908987 CEST	58483	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:29.401654959 CEST	53	58483	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:29.402066946 CEST	58484	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:29.423216105 CEST	53	58484	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:30.012593985 CEST	58485	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:30.033303976 CEST	53	58485	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:30.204734087 CEST	51889	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:30.819206953 CEST	53	51889	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:30.891808033 CEST	51890	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:30.911178112 CEST	53	51890	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:31.975245953 CEST	51891	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:31.996062040 CEST	53	51891	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:31.996526957 CEST	51892	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.016911030 CEST	53	51892	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.036712885 CEST	51893	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.055161953 CEST	53	51893	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.055555105 CEST	51894	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.077513933 CEST	53	51894	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.280885935 CEST	60418	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.328344107 CEST	53	60418	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.339962959 CEST	60419	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.360487938 CEST	53	60419	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.361099958 CEST	60420	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.381845951 CEST	53	60420	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.382333040 CEST	60421	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.402843952 CEST	53	60421	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.403374910 CEST	60422	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.423881054 CEST	53	60422	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.424187899 CEST	60423	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:32.444027901 CEST	53	60423	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:32.614773035 CEST	54283	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:33.602144957 CEST	54283	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:33.662503004 CEST	53	54283	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:33.674870014 CEST	54284	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:33.694170952 CEST	53	54284	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:33.695070028 CEST	54285	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:33.714600086 CEST	53	54285	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:33.715890884 CEST	54286	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:33.735584974 CEST	53	54286	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:33.736226082 CEST	54287	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:33.755711079 CEST	53	54287	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:33.756469965 CEST	54288	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:33.774130106 CEST	53	54288	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:33.940355062 CEST	59763	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:34.005925894 CEST	53	59763	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:34.015136957 CEST	59764	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:34.032443047 CEST	53	59764	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:34.032989979 CEST	59765	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:34.052963972 CEST	53	59765	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:34.053456068 CEST	59766	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:34.075452089 CEST	53	59766	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:34.075906992 CEST	59767	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:34.093806982 CEST	53	59767	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:34.095324039 CEST	59768	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:34.114725113 CEST	53	59768	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:34.286489964 CEST	54431	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:34.727765083 CEST	53	54283	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:35.289774895 CEST	54431	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:35.952977896 CEST	53	54431	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:35.959451914 CEST	54432	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:35.979208946 CEST	53	54432	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:35.979600906 CEST	54433	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:36.000792027 CEST	53	54433	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:36.001168966 CEST	54434	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:36.022969007 CEST	53	54434	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:36.023380995 CEST	54435	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:36.044903994 CEST	53	54435	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:36.045305967 CEST	54436	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:36.066387892 CEST	53	54436	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:36.244251013 CEST	65461	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:37.243447065 CEST	65461	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:37.278584003 CEST	53	65461	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:37.287781000 CEST	65462	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:37.308661938 CEST	53	65462	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:37.309587002 CEST	65463	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:37.330910921 CEST	53	65463	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:37.331573009 CEST	65464	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:37.351093054 CEST	53	65464	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:37.351948977 CEST	65465	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:37.372787952 CEST	53	65465	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:37.373698950 CEST	65466	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:37.393057108 CEST	53	65466	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:37.563853979 CEST	50090	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:38.572907925 CEST	50090	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:38.649069071 CEST	53	50090	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:38.657994032 CEST	50091	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:38.677830935 CEST	53	50091	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:38.678469896 CEST	50092	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:38.699517965 CEST	53	50092	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:38.699985027 CEST	50093	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:38.719789982 CEST	53	50093	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:38.722516060 CEST	50094	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:38.740737915 CEST	53	50094	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:38.741457939 CEST	50095	53	192.168.2.3	8.8.8.8
Sep 1, 2022 00:03:38.761935949 CEST	53	50095	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:39.094896078 CEST	53	54431	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:40.677587986 CEST	53	50090	8.8.8.8	192.168.2.3
Sep 1, 2022 00:03:41.002669096 CEST	53	65461	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 1, 2022 00:01:39.520570993 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:01:40.783612013 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:01:50.793490887 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:01:52.259394884 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:01.915915966 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:11.967726946 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:12.999253988 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:14.387639999 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:17.505326033 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:18.912524939 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:19.930841923 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:22.074431896 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:26.716536045 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:27.817651033 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:33.986866951 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:39.027971983 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:42.283472061 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:47.096530914 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:53.169331074 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:54.727473974 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:02:57.449881077 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:01.595396042 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:02.946669102 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:03.968327999 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:06.090796947 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:15.886845112 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:17.783652067 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:19.698307991 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:23.514821053 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:25.947057962 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:26.542293072 CEST	192.168.2.3	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:28.692326069 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:34.727960110 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:39.095027924 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable
Sep 1, 2022 00:03:40.678124905 CEST	192.168.2.3	8.8.8.8	d030	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 1, 2022 00:01:23.064902067 CEST	192.168.2.3	8.8.8.8	0x6ee5	Standard query (0)	ipv4bot.whatismyipaddress.com	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:23.994477034 CEST	192.168.2.3	8.8.8.8	0x76ae	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:24.049179077 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:24.068248034 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:24.090037107 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:24.124614954 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:24.145241976 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:25.247797012 CEST	192.168.2.3	8.8.8.8	0xb801	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:25.310718060 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:25.328521967 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:25.347117901 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:25.367458105 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:25.385521889 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:26.844472885 CEST	192.168.2.3	8.8.8.8	0xa52f	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:27.464441061 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:27.482734919 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:27.503001928 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:27.526552916 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:27.550731897 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:33.534245014 CEST	192.168.2.3	8.8.8.8	0x9347	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:34.150069952 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:34.170593023 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:34.192981005 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:34.214782953 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:34.235760927 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:35.764401913 CEST	192.168.2.3	8.8.8.8	0x69c7	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:36.800379992 CEST	192.168.2.3	8.8.8.8	0x69c7	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:37.845704079 CEST	192.168.2.3	8.8.8.8	0x69c7	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:38.440474033 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:38.460692883 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:38.479108095 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:38.500366926 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:38.529181004 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:39.759217024 CEST	192.168.2.3	8.8.8.8	0xc269	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:39.895581007 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:39.931324959 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:39.951734066 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:39.971865892 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:39.990387917 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:41.157733917 CEST	192.168.2.3	8.8.8.8	0xf1f3	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:41.261158943 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:41.280695915 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:41.302395105 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:41.321666956 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:41.349610090 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:42.602513075 CEST	192.168.2.3	8.8.8.8	0x8ba	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:42.666846037 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:42.686131001 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:42.707643986 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:42.729662895 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:42.750967026 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:43.750798941 CEST	192.168.2.3	8.8.8.8	0x25e1	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:43.818617105 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:43.838372946 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:43.859132051 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:43.883100033 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:43.903173923 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:44.873297930 CEST	192.168.2.3	8.8.8.8	0x51fb	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:45.432225943 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:45.451637030 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:45.473540068 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:45.495695114 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:45.515640020 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:46.825660944 CEST	192.168.2.3	8.8.8.8	0xb432	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:46.895714045 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:46.914019108 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:46.934129953 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:46.954180956 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:46.974641085 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:47.966227055 CEST	192.168.2.3	8.8.8.8	0x1543	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:48.969243050 CEST	192.168.2.3	8.8.8.8	0x1543	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:50.027492046 CEST	192.168.2.3	8.8.8.8	0x1543	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:50.193775892 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:50.247028112 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:50.267332077 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:50.489646912 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:50.543832064 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:52.586035013 CEST	192.168.2.3	8.8.8.8	0x84	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:53.206665039 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:53.226526976 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:53.251460075 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:53.271847010 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:53.290249109 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:54.258793116 CEST	192.168.2.3	8.8.8.8	0x1368	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:54.856652975 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:54.875889063 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:54.898417950 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:54.918395996 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:54.940366030 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:01:55.904305935 CEST	192.168.2.3	8.8.8.8	0xb069	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:56.898372889 CEST	192.168.2.3	8.8.8.8	0xb069	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:57.597537994 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:57.617695093 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:57.638087034 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:57.658266068 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:57.681284904 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:01:58.788856030 CEST	192.168.2.3	8.8.8.8	0x34ae	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:59.402009010 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:59.423880100 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:59.444335938 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:01:59.462826967 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:59.483040094 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:00.502871990 CEST	192.168.2.3	8.8.8.8	0x6c80	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:00.582490921 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:00.604247093 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:00.624524117 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:00.646017075 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:00.665796041 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:01.677488089 CEST	192.168.2.3	8.8.8.8	0xe958	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:01.768798113 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:01.788641930 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:01.814516068 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:01.832803965 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:01.851233959 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:02.841990948 CEST	192.168.2.3	8.8.8.8	0xb441	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:02.966444016 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:02.984507084 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:03.004766941 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:03.023139000 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:03.043257952 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:04.111052990 CEST	192.168.2.3	8.8.8.8	0xf2b7	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:04.748806953 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:04.768620968 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:04.790776014 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:04.820486069 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:04.842170000 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:05.931890965 CEST	192.168.2.3	8.8.8.8	0x3f9e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:06.949732065 CEST	192.168.2.3	8.8.8.8	0x3f9e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:07.982110023 CEST	192.168.2.3	8.8.8.8	0x3f9e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:10.088450909 CEST	192.168.2.3	8.8.8.8	0x3f9e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:11.685623884 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:11.706173897 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:11.726578951 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:11.746819973 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:11.767488003 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:12.846661091 CEST	192.168.2.3	8.8.8.8	0xfea3	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:13.892630100 CEST	192.168.2.3	8.8.8.8	0xfea3	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:14.908216953 CEST	192.168.2.3	8.8.8.8	0xfea3	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:14.995146036 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:15.015451908 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:15.036326885 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:15.057233095 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:15.078815937 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:15.420219898 CEST	192.168.2.3	8.8.8.8	0x80a9	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:16.408524990 CEST	192.168.2.3	8.8.8.8	0x80a9	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:16.468611002 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:16.489371061 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:16.509694099 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:16.532569885 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:16.558553934 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:16.953728914 CEST	192.168.2.3	8.8.8.8	0x731	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:17.000292063 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:17.026690006 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:17.049623013 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:17.069143057 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:17.089606047 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:17.824410915 CEST	192.168.2.3	8.8.8.8	0x84cb	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:18.368638039 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:18.389777899 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:18.409895897 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:18.428585052 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:18.458137989 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:18.825237036 CEST	192.168.2.3	8.8.8.8	0x49ea	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.409481049 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:19.430994987 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.450711966 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:19.472414017 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.492209911 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:19.849414110 CEST	192.168.2.3	8.8.8.8	0xeae8	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.932447910 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:19.952318907 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.973756075 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:19.994369984 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:20.014611959 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:20.450695992 CEST	192.168.2.3	8.8.8.8	0xc65d	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:21.440356970 CEST	192.168.2.3	8.8.8.8	0xc65d	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:22.031480074 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:22.051454067 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:22.069673061 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:22.089884996 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:22.108885050 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:22.575946093 CEST	192.168.2.3	8.8.8.8	0x4e9	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:23.581091881 CEST	192.168.2.3	8.8.8.8	0x4e9	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:24.596934080 CEST	192.168.2.3	8.8.8.8	0x4e9	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:24.728225946 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:24.749273062 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:24.770961046 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:24.792802095 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:24.814615965 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:25.179150105 CEST	192.168.2.3	8.8.8.8	0x7b7e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.190792084 CEST	192.168.2.3	8.8.8.8	0x7b7e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.252104998 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:26.273853064 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.294404984 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:26.312895060 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.333412886 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:26.695220947 CEST	192.168.2.3	8.8.8.8	0xd306	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.750152111 CEST	192.168.2.3	8.8.8.8	0xd306	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.858907938 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:27.883460045 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.905128002 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:27.969558001 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.993076086 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:29.601125002 CEST	192.168.2.3	8.8.8.8	0xefc8	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:32.371490955 CEST	192.168.2.3	8.8.8.8	0xefc8	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:32.404072046 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:32.423641920 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:32.443413973 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:32.467434883 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:32.489443064 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:32.867223024 CEST	192.168.2.3	8.8.8.8	0x4560	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:33.862488031 CEST	192.168.2.3	8.8.8.8	0x4560	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.417866945 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:34.435885906 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.463043928 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:34.497220993 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.518929958 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:34.851964951 CEST	192.168.2.3	8.8.8.8	0xbc32	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:35.437273979 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:35.455212116 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:35.476502895 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:35.496675014 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:35.516824961 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:35.859457016 CEST	192.168.2.3	8.8.8.8	0x55ac	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:35.995635033 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:36.017096996 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:36.035378933 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:36.053729057 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:36.072251081 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:36.459953070 CEST	192.168.2.3	8.8.8.8	0xf2bb	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:37.472609997 CEST	192.168.2.3	8.8.8.8	0xf2bb	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:38.497634888 CEST	192.168.2.3	8.8.8.8	0xf2bb	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:38.640486956 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:38.660218000 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:38.683294058 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:38.719558001 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:38.738598108 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:39.088742971 CEST	192.168.2.3	8.8.8.8	0x7eea	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.691652060 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:39.711365938 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.730597973 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:39.751533031 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.772185087 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:40.153419018 CEST	192.168.2.3	8.8.8.8	0x6727	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:41.172076941 CEST	192.168.2.3	8.8.8.8	0x6727	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:41.842334986 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:41.862104893 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:41.882664919 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:41.903320074 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:41.921899080 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:42.277318001 CEST	192.168.2.3	8.8.8.8	0x27ee	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.285449982 CEST	192.168.2.3	8.8.8.8	0x27ee	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.328716993 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:43.346779108 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.367193937 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:43.387386084 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.405654907 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:43.751919985 CEST	192.168.2.3	8.8.8.8	0xdd39	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.286156893 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:44.306859970 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.327136040 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:44.347197056 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.367091894 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:44.774935961 CEST	192.168.2.3	8.8.8.8	0x7cf8	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.827179909 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:44.846894979 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.867082119 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:44.887150049 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.909322977 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:45.564925909 CEST	192.168.2.3	8.8.8.8	0xa05d	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:46.551074982 CEST	192.168.2.3	8.8.8.8	0xa05d	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:46.632401943 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:46.656883001 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:46.678054094 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:46.696702003 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:46.717207909 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:47.066291094 CEST	192.168.2.3	8.8.8.8	0xb75e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:47.102243900 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:47.119975090 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:47.139273882 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:47.160135031 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:47.180254936 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:48.143838882 CEST	192.168.2.3	8.8.8.8	0x9344	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:48.243660927 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:48.263272047 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:48.283085108 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:48.340517998 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:48.360270023 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:48.992279053 CEST	192.168.2.3	8.8.8.8	0x9098	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:49.039655924 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:49.105935097 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:49.126044989 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:49.146584034 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:49.211679935 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:50.544686079 CEST	192.168.2.3	8.8.8.8	0xc31f	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:52.608259916 CEST	192.168.2.3	8.8.8.8	0xc31f	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:52.628920078 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:52.648139954 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:52.669550896 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:52.691628933 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:52.764321089 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:53.163081884 CEST	192.168.2.3	8.8.8.8	0xddd1	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:53.207458973 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:53.228133917 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:53.250638962 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:53.276937962 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:53.296910048 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:53.660832882 CEST	192.168.2.3	8.8.8.8	0x1cca	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.678829908 CEST	192.168.2.3	8.8.8.8	0x1cca	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.715509892 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:54.735838890 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.755738974 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:54.777870893 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.805593014 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:55.193733931 CEST	192.168.2.3	8.8.8.8	0x7331	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.231367111 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:55.260307074 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.282820940 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:55.304130077 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.325848103 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:02:55.844996929 CEST	192.168.2.3	8.8.8.8	0x8ac0	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.932115078 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:55.953111887 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.974494934 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:55.995863914 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:56.017085075 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:02:56.404357910 CEST	192.168.2.3	8.8.8.8	0xc34e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.411904097 CEST	192.168.2.3	8.8.8.8	0xc34e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.447629929 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:57.467935085 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.492444992 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:57.512286901 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.542714119 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:02:57.924940109 CEST	192.168.2.3	8.8.8.8	0xe6aa	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:58.928544044 CEST	192.168.2.3	8.8.8.8	0xe6aa	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:59.943011045 CEST	192.168.2.3	8.8.8.8	0xe6aa	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:00.017366886 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:00.036817074 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:00.057399988 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:00.076893091 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:00.100399017 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:00.563648939 CEST	192.168.2.3	8.8.8.8	0x1ea	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.554763079 CEST	192.168.2.3	8.8.8.8	0x1ea	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.601682901 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:01.623106956 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.644612074 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:01.665771961 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.687030077 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:02.153387070 CEST	192.168.2.3	8.8.8.8	0x9670	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:02.801975012 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:02.822494030 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:02.844405890 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:02.900983095 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:02.922605991 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:03.343214035 CEST	192.168.2.3	8.8.8.8	0x101c	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:03.427838087 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:03.448040962 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:03.466197014 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:03.486265898 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:03.506251097 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:03.962084055 CEST	192.168.2.3	8.8.8.8	0x1236	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:04.974921942 CEST	192.168.2.3	8.8.8.8	0x1236	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:05.594440937 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:05.617213011 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:05.639385939 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:05.661525011 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:05.683602095 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:06.123651028 CEST	192.168.2.3	8.8.8.8	0x32f7	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:06.260365963 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:06.280270100 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:06.300781012 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:06.319112062 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:06.339869022 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:06.701911926 CEST	192.168.2.3	8.8.8.8	0xf50d	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:07.240674019 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:07.276021957 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:07.301197052 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:07.325311899 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:07.346616983 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:08.098186970 CEST	192.168.2.3	8.8.8.8	0x5b1c	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:08.720036983 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:08.745096922 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:08.807703018 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:08.828383923 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:08.846909046 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:11.312613964 CEST	192.168.2.3	8.8.8.8	0xb93e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:13.124238968 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:13.145962954 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:13.168036938 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:13.188986063 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:13.209944010 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:13.699589014 CEST	192.168.2.3	8.8.8.8	0x78aa	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:14.710131884 CEST	192.168.2.3	8.8.8.8	0x78aa	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.711199999 CEST	192.168.2.3	8.8.8.8	0x78aa	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.883177996 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:15.903464079 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.922110081 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:15.942186117 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.960644960 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:16.393064976 CEST	192.168.2.3	8.8.8.8	0xd2e7	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:17.397872925 CEST	192.168.2.3	8.8.8.8	0xd2e7	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.001125097 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:18.020601034 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.040652990 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:18.060822964 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.082511902 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:18.621407986 CEST	192.168.2.3	8.8.8.8	0xe3b2	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.657192945 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:18.677170992 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.697258949 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:18.717463970 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.737468004 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:19.167845011 CEST	192.168.2.3	8.8.8.8	0x6266	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.219196081 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:19.239136934 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.259211063 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:19.277164936 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.297074080 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:19.834583998 CEST	192.168.2.3	8.8.8.8	0x8bb8	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.952431917 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:19.972138882 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.992460012 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:20.011368036 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.034172058 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:20.228393078 CEST	192.168.2.3	8.8.8.8	0x3233	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.265758991 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:20.284135103 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.304409027 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:20.324394941 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.348262072 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:20.534615040 CEST	192.168.2.3	8.8.8.8	0x9a4b	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:21.523137093 CEST	192.168.2.3	8.8.8.8	0x9a4b	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:21.620418072 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:21.642301083 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:21.664385080 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:21.687511921 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:21.709351063 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:21.888966084 CEST	192.168.2.3	8.8.8.8	0x6c47	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:22.898207903 CEST	192.168.2.3	8.8.8.8	0x6c47	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:22.935939074 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:22.956962109 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:22.978908062 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:23.000022888 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:23.021548986 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:23.209656954 CEST	192.168.2.3	8.8.8.8	0x878d	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:23.980442047 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:23.998657942 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:24.019182920 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:24.040007114 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:24.060420036 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:24.239500046 CEST	192.168.2.3	8.8.8.8	0xa1ca	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.226500988 CEST	192.168.2.3	8.8.8.8	0xa1ca	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.263760090 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:25.281759977 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.300157070 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:25.320561886 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.341169119 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:25.538189888 CEST	192.168.2.3	8.8.8.8	0xa11d	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.576621056 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:25.594151020 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.612011909 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:25.632008076 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.650229931 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:25.840779066 CEST	192.168.2.3	8.8.8.8	0xc72e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.836159945 CEST	192.168.2.3	8.8.8.8	0xc72e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.882740974 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:26.907030106 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.929732084 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:26.954768896 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.976847887 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:27.174635887 CEST	192.168.2.3	8.8.8.8	0xb6ea	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.164587021 CEST	192.168.2.3	8.8.8.8	0xb6ea	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.343839884 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:28.363595009 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.520062923 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:28.538480043 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.558638096 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:28.762604952 CEST	192.168.2.3	8.8.8.8	0xe04e	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:29.344712973 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:29.362481117 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:29.383908987 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:29.402066946 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:30.012593985 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:30.204734087 CEST	192.168.2.3	8.8.8.8	0x83d5	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:30.891808033 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:31.975245953 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:31.996526957 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:32.036712885 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.055555105 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:32.280885935 CEST	192.168.2.3	8.8.8.8	0x14b6	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.339962959 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:32.361099958 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.382333040 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:32.403374910 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.424187899 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:32.614773035 CEST	192.168.2.3	8.8.8.8	0xedca	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:33.602144957 CEST	192.168.2.3	8.8.8.8	0xedca	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:33.674870014 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:33.695070028 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:33.715890884 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:33.736226082 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:33.756469965 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:33.940355062 CEST	192.168.2.3	8.8.8.8	0xa3fc	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:34.015136957 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:34.032989979 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:34.053456068 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:34.075906992 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:34.095324039 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:34.286489964 CEST	192.168.2.3	8.8.8.8	0xbc05	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:35.289774895 CEST	192.168.2.3	8.8.8.8	0xbc05	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:35.959451914 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:35.979600906 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:36.001168966 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:36.023380995 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	nomoreransom.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:36.045305967 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	nomoreransom.bit	28	IN (0x0001)
Sep 1, 2022 00:03:36.244251013 CEST	192.168.2.3	8.8.8.8	0x25c4	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:37.243447065 CEST	192.168.2.3	8.8.8.8	0x25c4	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:37.287781000 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:37.309587002 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:37.331573009 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:37.351948977 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	emsisoft.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:37.373698950 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	emsisoft.bit	28	IN (0x0001)
Sep 1, 2022 00:03:37.563853979 CEST	192.168.2.3	8.8.8.8	0x8bc	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:38.572907925 CEST	192.168.2.3	8.8.8.8	0x8bc	Standard query (0)	dns1.soprodns.ru	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:38.657994032 CEST	192.168.2.3	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:38.678469896 CEST	192.168.2.3	8.8.8.8	0x2	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:38.699985027 CEST	192.168.2.3	8.8.8.8	0x3	Standard query (0)	gandcrab.bit	28	IN (0x0001)
Sep 1, 2022 00:03:38.722516060 CEST	192.168.2.3	8.8.8.8	0x4	Standard query (0)	gandcrab.bit	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:38.741457939 CEST	192.168.2.3	8.8.8.8	0x5	Standard query (0)	gandcrab.bit	28	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 1, 2022 00:01:24.030497074 CEST	8.8.8.8	192.168.2.3	0x76ae	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:24.067482948 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:24.088715076 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:24.110754013 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:24.144764900 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:24.164725065 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:25.283262014 CEST	8.8.8.8	192.168.2.3	0xb801	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:25.327796936 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:25.346643925 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:25.366964102 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:25.385024071 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:25.405503035 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:27.449457884 CEST	8.8.8.8	192.168.2.3	0xa52f	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:27.481861115 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:27.502418995 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:27.520689964 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:27.550129890 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:27.573137045 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:34.108952045 CEST	8.8.8.8	192.168.2.3	0x9347	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:34.169861078 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:34.192428112 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:34.214257956 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:34.234899998 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:34.256675959 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:38.424983025 CEST	8.8.8.8	192.168.2.3	0x69c7	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:38.459913969 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:38.478588104 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:38.499536037 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:38.522388935 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:38.547306061 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:39.520437956 CEST	8.8.8.8	192.168.2.3	0x69c7	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:39.869720936 CEST	8.8.8.8	192.168.2.3	0xc269	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:39.914973974 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:39.951137066 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:39.971240997 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:39.989907026 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:40.010957003 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:40.783550978 CEST	8.8.8.8	192.168.2.3	0x69c7	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:41.194181919 CEST	8.8.8.8	192.168.2.3	0xf1f3	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:41.280056000 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:41.300605059 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:41.320178032 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:41.341320992 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:41.369268894 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:42.639774084 CEST	8.8.8.8	192.168.2.3	0x8ba	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:42.685431004 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:42.707127094 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:42.729058981 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:42.750449896 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:42.771682978 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:43.786712885 CEST	8.8.8.8	192.168.2.3	0x25e1	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:43.837654114 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:43.857835054 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:43.878863096 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:43.902585030 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:43.922862053 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:45.412717104 CEST	8.8.8.8	192.168.2.3	0x51fb	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:45.450937986 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:45.472791910 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:45.495043039 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:45.514930964 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:45.535151958 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:46.863656044 CEST	8.8.8.8	192.168.2.3	0xb432	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:46.913108110 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:46.933680058 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:46.953710079 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:46.973721981 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:46.994463921 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:50.163376093 CEST	8.8.8.8	192.168.2.3	0x1543	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:50.211262941 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:50.265369892 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:50.285290956 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:50.507364035 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:50.561597109 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:50.793282986 CEST	8.8.8.8	192.168.2.3	0x1543	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:52.259315968 CEST	8.8.8.8	192.168.2.3	0x1543	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:53.162805080 CEST	8.8.8.8	192.168.2.3	0x84	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:53.225925922 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:53.246345043 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:53.271325111 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:53.289664030 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:53.310367107 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:54.812717915 CEST	8.8.8.8	192.168.2.3	0x1368	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:54.875181913 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:54.897751093 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:54.917856932 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:54.939847946 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:54.961664915 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:57.544912100 CEST	8.8.8.8	192.168.2.3	0xb069	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:57.616928101 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:57.637340069 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:57.657670021 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:57.680296898 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:57.700737000 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:59.361457109 CEST	8.8.8.8	192.168.2.3	0x34ae	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:59.421237946 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:01:59.443866014 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:59.462193966 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:01:59.482578039 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:01:59.500787973 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:00.540338039 CEST	8.8.8.8	192.168.2.3	0x6c80	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:00.602976084 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:00.623477936 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:00.645464897 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:00.665227890 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:00.686867952 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:01.711468935 CEST	8.8.8.8	192.168.2.3	0xe958	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:01.787820101 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:01.813957930 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:01.832298040 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:01.850697994 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:01.870028019 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:01.915724039 CEST	8.8.8.8	192.168.2.3	0xb069	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:02.924088001 CEST	8.8.8.8	192.168.2.3	0xb441	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:02.983864069 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:03.004199028 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:03.022608995 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:03.041289091 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:03.060731888 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:04.694045067 CEST	8.8.8.8	192.168.2.3	0xf2b7	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:04.767615080 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:04.790055037 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:04.812170982 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:04.841615915 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:04.861390114 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:10.950472116 CEST	8.8.8.8	192.168.2.3	0x3f9e	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:11.704813957 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:11.725864887 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:11.746112108 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:11.766913891 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:11.787333965 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:11.967653036 CEST	8.8.8.8	192.168.2.3	0x3f9e	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:12.999161005 CEST	8.8.8.8	192.168.2.3	0x3f9e	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:14.387511015 CEST	8.8.8.8	192.168.2.3	0x3f9e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:14.971482038 CEST	8.8.8.8	192.168.2.3	0xfea3	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:15.014755964 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:15.035367012 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:15.056536913 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:15.078147888 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:15.099627018 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:16.448688984 CEST	8.8.8.8	192.168.2.3	0x80a9	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:16.488795042 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:16.509176016 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:16.530898094 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:16.553879023 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:16.580022097 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:16.991344929 CEST	8.8.8.8	192.168.2.3	0x731	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:17.021205902 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:17.048921108 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:17.068710089 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:17.089041948 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:17.109560966 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:17.505155087 CEST	8.8.8.8	192.168.2.3	0x80a9	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:18.361676931 CEST	8.8.8.8	192.168.2.3	0x84cb	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:18.389043093 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:18.408541918 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:18.427966118 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:18.449790001 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:18.479060888 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:18.912440062 CEST	8.8.8.8	192.168.2.3	0xfea3	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.401741028 CEST	8.8.8.8	192.168.2.3	0x49ea	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.430453062 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:19.450289965 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.471883059 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:19.491760969 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.512691975 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:19.925700903 CEST	8.8.8.8	192.168.2.3	0xeae8	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.930727959 CEST	8.8.8.8	192.168.2.3	0xfea3	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.951675892 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:19.970587015 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:19.993907928 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:20.013947010 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:20.035240889 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:22.022486925 CEST	8.8.8.8	192.168.2.3	0xc65d	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:22.050517082 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:22.069267035 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:22.074369907 CEST	8.8.8.8	192.168.2.3	0xc65d	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:22.089488983 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:22.108500004 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:22.129991055 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:24.712889910 CEST	8.8.8.8	192.168.2.3	0x4e9	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:24.748702049 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:24.770515919 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:24.792413950 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:24.814188957 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:24.833614111 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:26.233566046 CEST	8.8.8.8	192.168.2.3	0x7b7e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.270071030 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:26.293915987 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.312290907 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:26.332462072 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.352917910 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:26.714562893 CEST	8.8.8.8	192.168.2.3	0x4e9	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:26.841078043 CEST	8.8.8.8	192.168.2.3	0x4e9	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.386841059 CEST	8.8.8.8	192.168.2.3	0x7b7e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.784187078 CEST	8.8.8.8	192.168.2.3	0xd306	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.817483902 CEST	8.8.8.8	192.168.2.3	0xd306	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.877135992 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:27.904680967 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:27.926455975 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:27.989053965 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:28.014046907 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:30.826258898 CEST	8.8.8.8	192.168.2.3	0xefc8	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:32.422898054 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:32.442924023 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:32.465111017 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:32.486720085 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:32.510637999 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:33.985611916 CEST	8.8.8.8	192.168.2.3	0xefc8	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.407073975 CEST	8.8.8.8	192.168.2.3	0x4560	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.435112000 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:34.459167957 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.484791994 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:34.489913940 CEST	8.8.8.8	192.168.2.3	0x4560	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.517954111 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:34.537820101 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:35.427285910 CEST	8.8.8.8	192.168.2.3	0xbc32	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:35.454541922 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:35.475027084 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:35.496222973 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:35.516345024 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:35.536685944 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:35.984587908 CEST	8.8.8.8	192.168.2.3	0x55ac	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:36.012811899 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:36.034972906 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:36.053332090 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:36.071810961 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:36.091907978 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:38.631139994 CEST	8.8.8.8	192.168.2.3	0xf2bb	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:38.659338951 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:38.680645943 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:38.701905012 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:38.738066912 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:38.759218931 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:39.027879000 CEST	8.8.8.8	192.168.2.3	0xf2bb	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.143616915 CEST	8.8.8.8	192.168.2.3	0xf2bb	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.675185919 CEST	8.8.8.8	192.168.2.3	0x7eea	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.710722923 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:39.729000092 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.750302076 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:39.771075010 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:39.791596889 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:41.822036982 CEST	8.8.8.8	192.168.2.3	0x6727	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:41.861427069 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:41.881999969 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:41.902828932 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:41.921314955 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:41.941456079 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:42.283397913 CEST	8.8.8.8	192.168.2.3	0x6727	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.320070028 CEST	8.8.8.8	192.168.2.3	0x27ee	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.345973015 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:43.366689920 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.386923075 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:43.405071020 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:43.425419092 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:44.279233932 CEST	8.8.8.8	192.168.2.3	0xdd39	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.305149078 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:44.326653957 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.346456051 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:44.366677999 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.386941910 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:44.819075108 CEST	8.8.8.8	192.168.2.3	0x7cf8	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.846179008 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:44.864609003 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.886693001 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:44.908752918 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:44.929284096 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:46.625612020 CEST	8.8.8.8	192.168.2.3	0xa05d	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:46.652822018 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:46.677609921 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:46.696248055 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:46.716310978 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:46.736613989 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:47.092792034 CEST	8.8.8.8	192.168.2.3	0xb75e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:47.096024036 CEST	8.8.8.8	192.168.2.3	0xa05d	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:47.119285107 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:47.137702942 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:47.159663916 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:47.179497957 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:47.199672937 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:47.295221090 CEST	8.8.8.8	192.168.2.3	0x27ee	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:48.169800997 CEST	8.8.8.8	192.168.2.3	0x9344	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:48.262660027 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:48.282622099 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:48.302493095 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:48.359857082 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:48.378109932 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:49.030847073 CEST	8.8.8.8	192.168.2.3	0x9098	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:49.060447931 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:49.125612974 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:49.145709991 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:49.164716959 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:49.230854988 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:51.666511059 CEST	8.8.8.8	192.168.2.3	0xc31f	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:52.647394896 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:52.669127941 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:52.691092014 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:52.712511063 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:52.786346912 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:53.169249058 CEST	8.8.8.8	192.168.2.3	0xc31f	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:53.199151039 CEST	8.8.8.8	192.168.2.3	0xddd1	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:53.227545977 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:53.250277996 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:53.274090052 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:53.296488047 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:53.315620899 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:54.707915068 CEST	8.8.8.8	192.168.2.3	0x1cca	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.727380991 CEST	8.8.8.8	192.168.2.3	0x1cca	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.735213995 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:54.755316019 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.777358055 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:54.797842026 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:54.826921940 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:55.222019911 CEST	8.8.8.8	192.168.2.3	0x7331	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.248954058 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:55.282449961 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.303663969 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:55.325366020 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.344696999 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:55.919511080 CEST	8.8.8.8	192.168.2.3	0x8ac0	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.952475071 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:55.974069118 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:55.995476007 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:56.016655922 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:56.038196087 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:57.439387083 CEST	8.8.8.8	192.168.2.3	0xc34e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.449079037 CEST	8.8.8.8	192.168.2.3	0xc34e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.467147112 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:02:57.488708973 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.511897087 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:02:57.530978918 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:02:57.561358929 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:00.010236025 CEST	8.8.8.8	192.168.2.3	0xe6aa	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:00.035882950 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:00.057038069 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:00.076392889 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:00.097615957 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:00.121129990 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:01.584554911 CEST	8.8.8.8	192.168.2.3	0x1ea	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.595273972 CEST	8.8.8.8	192.168.2.3	0x1ea	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.622442007 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:01.644107103 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.665334940 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:01.686562061 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:01.706001043 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:02.779787064 CEST	8.8.8.8	192.168.2.3	0x9670	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:02.821990013 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:02.843368053 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:02.865358114 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:02.922287941 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:02.942126989 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:02.945770025 CEST	8.8.8.8	192.168.2.3	0xe6aa	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:03.418770075 CEST	8.8.8.8	192.168.2.3	0x101c	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:03.446106911 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:03.465781927 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:03.485872984 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:03.505850077 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:03.524724007 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:03.967163086 CEST	8.8.8.8	192.168.2.3	0xe6aa	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:05.580583096 CEST	8.8.8.8	192.168.2.3	0x1236	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:05.616434097 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:05.638950109 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:05.661201954 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:05.683096886 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:05.704983950 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:06.090673923 CEST	8.8.8.8	192.168.2.3	0x1236	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:06.253566980 CEST	8.8.8.8	192.168.2.3	0x32f7	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:06.279741049 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:06.300148010 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:06.318766117 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:06.339133978 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:06.360065937 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:07.230133057 CEST	8.8.8.8	192.168.2.3	0xf50d	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:07.261197090 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:07.297318935 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:07.321963072 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:07.345874071 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:07.367491961 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:08.672029018 CEST	8.8.8.8	192.168.2.3	0x5b1c	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:08.740346909 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:08.766110897 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:08.827946901 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:08.846530914 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:08.866904974 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:11.907406092 CEST	8.8.8.8	192.168.2.3	0xb93e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:13.145453930 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:13.167514086 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:13.187902927 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:13.209469080 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:13.232753992 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:15.875538111 CEST	8.8.8.8	192.168.2.3	0x78aa	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.886709929 CEST	8.8.8.8	192.168.2.3	0x78aa	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.902874947 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:15.921664953 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.941783905 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:15.960310936 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:15.978528023 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:17.783536911 CEST	8.8.8.8	192.168.2.3	0x78aa	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:17.989558935 CEST	8.8.8.8	192.168.2.3	0xd2e7	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.019994974 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:18.040131092 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.060370922 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:18.080894947 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.102590084 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:18.650096893 CEST	8.8.8.8	192.168.2.3	0xe3b2	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.676616907 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:18.696774960 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.717092037 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:18.736999989 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:18.754909992 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:19.210956097 CEST	8.8.8.8	192.168.2.3	0x6266	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.238610029 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:19.258774996 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.276746988 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:19.296673059 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.316821098 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:19.696104050 CEST	8.8.8.8	192.168.2.3	0xd2e7	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.938867092 CEST	8.8.8.8	192.168.2.3	0x8bb8	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:19.971436024 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:19.991856098 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.010216951 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:20.031111956 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.051709890 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:20.256568909 CEST	8.8.8.8	192.168.2.3	0x3233	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.283133984 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:20.303747892 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.323898077 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:20.344026089 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:20.366065979 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:21.609051943 CEST	8.8.8.8	192.168.2.3	0x9a4b	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:21.641108990 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:21.663789988 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:21.686964035 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:21.708765030 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:21.729496956 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:22.926181078 CEST	8.8.8.8	192.168.2.3	0x6c47	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:22.956406116 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:22.978058100 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:22.999502897 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:23.021095037 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:23.042824030 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:23.514621973 CEST	8.8.8.8	192.168.2.3	0x6c47	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:23.968266010 CEST	8.8.8.8	192.168.2.3	0x878d	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:23.997780085 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:24.018424988 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:24.039185047 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:24.059684038 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:24.078253031 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:25.255103111 CEST	8.8.8.8	192.168.2.3	0xa1ca	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.281069994 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:25.299524069 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.319861889 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:25.340485096 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.361062050 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:25.566684961 CEST	8.8.8.8	192.168.2.3	0xa11d	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.593641996 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:25.611632109 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.631575108 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:25.649888039 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:25.669991970 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:25.946975946 CEST	8.8.8.8	192.168.2.3	0xa1ca	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.542138100 CEST	8.8.8.8	192.168.2.3	0x9a4b	Server failure (2)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.874851942 CEST	8.8.8.8	192.168.2.3	0xc72e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.904150963 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:26.929198980 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.951956987 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:26.976304054 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:26.997859001 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:26.998966932 CEST	8.8.8.8	192.168.2.3	0xc72e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.328942060 CEST	8.8.8.8	192.168.2.3	0xb6ea	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.362921000 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:28.383085012 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.538108110 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:28.558254004 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:28.578342915 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:28.692234039 CEST	8.8.8.8	192.168.2.3	0xb6ea	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:29.338186979 CEST	8.8.8.8	192.168.2.3	0xe04e	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:29.362001896 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:29.383466005 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:29.401654959 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:29.423216105 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:30.033303976 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:30.819206953 CEST	8.8.8.8	192.168.2.3	0x83d5	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:30.911178112 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:31.996062040 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.016911030 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:32.055161953 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.077513933 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:32.328344107 CEST	8.8.8.8	192.168.2.3	0x14b6	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.360487938 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:32.381845951 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.402843952 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:32.423881054 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:32.444027901 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:33.662503004 CEST	8.8.8.8	192.168.2.3	0xedca	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:33.694170952 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:33.714600086 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:33.735584974 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:33.755711079 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:33.774130106 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:34.005925894 CEST	8.8.8.8	192.168.2.3	0xa3fc	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:34.032443047 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:34.052963972 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:34.075452089 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:34.093806982 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:34.114725113 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:34.727765083 CEST	8.8.8.8	192.168.2.3	0xedca	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:35.952977896 CEST	8.8.8.8	192.168.2.3	0xbc05	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:35.979208946 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:36.000792027 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:36.022969007 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:36.044903994 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	nomoreransom.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:36.066387892 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	nomoreransom.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:37.278584003 CEST	8.8.8.8	192.168.2.3	0x25c4	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:37.308661938 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:37.330910921 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:37.351093054 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:37.372787952 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	emsisoft.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:37.393057108 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	emsisoft.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:38.649069071 CEST	8.8.8.8	192.168.2.3	0x8bc	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:38.677830935 CEST	8.8.8.8	192.168.2.3	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 1, 2022 00:03:38.699517965 CEST	8.8.8.8	192.168.2.3	0x2	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:38.719789982 CEST	8.8.8.8	192.168.2.3	0x3	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:38.740737915 CEST	8.8.8.8	192.168.2.3	0x4	Name error (3)	gandcrab.bit	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:38.761935949 CEST	8.8.8.8	192.168.2.3	0x5	Name error (3)	gandcrab.bit	none	none	28	IN (0x0001)
Sep 1, 2022 00:03:39.094896078 CEST	8.8.8.8	192.168.2.3	0xbc05	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:40.677587986 CEST	8.8.8.8	192.168.2.3	0x8bc	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 00:03:41.002669096 CEST	8.8.8.8	192.168.2.3	0x25c4	Name error (3)	dns1.soprodns.ru	none	none	A (IP address)	IN (0x0001)

Target ID:	1
Start time:	00:01:12
Start date:	01/09/2022
Path:	C:\Users\user\Desktop\9gkAKTWOXp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9gkAKTWOXp.exe"
Imagebase:	0x400000
File size:	75264 bytes
MD5 hash:	74E135B472B7496B371CE3BA3ACFEEA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000001.00000000.253403415.000000000040E000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000001.00000002.561907295.000000000040E000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: nslookup.exePID: 5752, Parent PID: 4664

General

Target ID:	5
Start time:	00:01:21
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: conhost.exePID: 5460, Parent PID: 5752

General

Target ID:	6
Start time:	00:01:22
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: nslookup.exePID: 484, Parent PID: 4664

General

Target ID:	7
Start time:	00:01:23
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup emsisoft.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: conhost.exePID: 1944, Parent PID: 484

General

Target ID:	8
Start time:	00:01:23
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: nslookup.exePID: 5368, Parent PID: 4664

General

Target ID:	9
Start time:	00:01:24
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup gandcrab.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: conhost.exePID: 4184, Parent PID: 5368

General

Target ID:	10
Start time:	00:01:25
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: nslookup.exePID: 6080, Parent PID: 4664

General

Target ID:	12
Start time:	00:01:26
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: vkspii.exePID: 6028, Parent PID: 3452

General

Target ID:	13
Start time:	00:01:27
Start date:	01/09/2022
Path:	C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe"
Imagebase:	0x400000
File size:	75264 bytes
MD5 hash:	551DA842D854798E9D42602EB420BD96
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 0000000D.00000002.295326787.000000000040E000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 0000000D.00000000.288179215.000000000040E000.00000008.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 0000000D.00000002.295333499.0000000000412000.00000008.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: SUSP_RANSOMWARE_Indicator_Jul20, Description: Detects ransomware indicator, Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, Author: Florian Roth Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, Author: Joe Security Rule: Gandcrab, Description: Gandcrab Payload, Source: C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe, Author: kevoreilly
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: conhost.exePID: 5208, Parent PID: 6080

General

Target ID:	14
Start time:	00:01:31
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 3232, Parent PID: 4664

General

Target ID:	16
Start time:	00:01:33
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup emsisoft.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5816, Parent PID: 3232

General

Target ID:	18
Start time:	00:01:33
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: vkspii.exePID: 4024, Parent PID: 3452

General

Target ID:	21
Start time:	00:01:35
Start date:	01/09/2022
Path:	C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe"
Imagebase:	0x400000
File size:	75264 bytes
MD5 hash:	551DA842D854798E9D42602EB420BD96
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000015.00000002.305269157.000000000040E000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000015.00000000.302558828.000000000040E000.00000008.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000015.00000002.305274923.0000000000412000.00000008.00000001.01000000.00000006.sdmp, Author: Joe Security

Analysis Process: nslookup.exePID: 3460, Parent PID: 4664

General

Target ID:	24
Start time:	00:01:37
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup gandcrab.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 3880, Parent PID: 3460

General

Target ID:	25
Start time:	00:01:37
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 408, Parent PID: 4664

General

Target ID:	26
Start time:	00:01:38
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5920, Parent PID: 408

General

Target ID:	27
Start time:	00:01:39
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 996, Parent PID: 4664

General

Target ID:	29
Start time:	00:01:40
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup emsisoft.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5116, Parent PID: 996

General

Target ID:	30
Start time:	00:01:40
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff651c80000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 5780, Parent PID: 4664

General

Target ID:	31
Start time:	00:01:41
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup gandcrab.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5360, Parent PID: 5780

General

Target ID:	32
Start time:	00:01:42
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 5880, Parent PID: 4664

General

Target ID:	33
Start time:	00:01:42
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 4272, Parent PID: 5880

General

Target ID:	34
Start time:	00:01:43
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 4948, Parent PID: 4664

General

Target ID:	35
Start time:	00:01:44
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup emsisoft.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 1328, Parent PID: 4948

General

Target ID:	36
Start time:	00:01:45
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 6064, Parent PID: 4664

General

Target ID:	37
Start time:	00:01:45
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup gandcrab.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 1976, Parent PID: 6064

General

Target ID:	39
Start time:	00:01:46
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 5784, Parent PID: 4664

General

Target ID:	41
Start time:	00:01:50
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5956, Parent PID: 5784

General

Target ID:	42
Start time:	00:01:50
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 2516, Parent PID: 4664

General

Target ID:	43
Start time:	00:01:52
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup emsisoft.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 3184, Parent PID: 2516

General

Target ID:	44
Start time:	00:01:52
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 576, Parent PID: 4664

General

Target ID:	45
Start time:	00:01:53
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup gandcrab.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5500, Parent PID: 576

General

Target ID:	46
Start time:	00:01:54
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 5964, Parent PID: 4664

General

Target ID:	47
Start time:	00:01:56
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5972, Parent PID: 5964

General

Target ID:	48
Start time:	00:01:57
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75a330000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 4512, Parent PID: 4664

General

Target ID:	49
Start time:	00:01:58
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup emsisoft.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 1360, Parent PID: 4512

General

Target ID:	50
Start time:	00:01:58
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 1556, Parent PID: 4664

General

Target ID:	51
Start time:	00:01:59
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup gandcrab.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 2140, Parent PID: 1556

General

Target ID:	52
Start time:	00:01:59
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 2764, Parent PID: 4664

General

Target ID:	53
Start time:	00:02:00
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 4820, Parent PID: 2764

General

Target ID:	54
Start time:	00:02:01
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 4272, Parent PID: 4664

General

Target ID:	55
Start time:	00:02:01
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup emsisoft.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 3184, Parent PID: 4272

General

Target ID:	56
Start time:	00:02:02
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 5236, Parent PID: 4664

General

Target ID:	57
Start time:	00:02:03
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup gandcrab.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 4996, Parent PID: 5236

General

Target ID:	58
Start time:	00:02:04
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: nslookup.exePID: 5708, Parent PID: 4664

General

Target ID:	60
Start time:	00:02:10
Start date:	01/09/2022
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup nomoreransom.bit dns1.soprodns.ru
Imagebase:	0x2c0000
File size:	78336 bytes
MD5 hash:	8E82529D1475D67615ADCB4E1B8F4EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 3196, Parent PID: 5708

General

Target ID:	61
Start time:	00:02:11
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9gkAKTWOXp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\Microsoft\vkspii.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
9gkAKTWOXp.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre