Edit tour
Windows
Analysis Report
download.exe
Overview
General Information
| Sample Name: | download.exe |
| Analysis ID: | 830512 |
| MD5: | 064fa36da0c2ca360b0906cc5bfe67c6 |
| SHA1: | a6623c33cbd86bdaee063f897bea1692621494e5 |
| SHA256: | 6974c5051372213d0e90147660c4b21bfff238e20c6449acb19f1901bf4729c8 |
| Infos: |  |
 | |
Detection
GuLoader
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Yara detected GuLoader
Writes to foreign memory regions
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses 32bit PE files
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
PE file does not import any functions
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
PE / OLE file has an invalid certificate
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard
Classification
- System is w10x64native
download.exe (PID: 8540 cmdline:
C:\Users\u ser\Deskto p\download .exe MD5: 064FA36DA0C2CA360B0906CC5BFE67C6) 
CasPol.exe (PID: 924 cmdline: C:\Users\u ser\Deskto p\download .exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD) 
conhost.exe (PID: 4728 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_3 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_3 | Yara detected GuLoader | Joe Security |
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 2_2_00405745 | |
| Source: | Code function: | 2_2_004026FE | |
| Source: | Code function: | 2_2_00406280 | |
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | Code function: | 2_2_004051E2 | |
| Source: | Static PE information: | ||
| Source: | Code function: | 2_2_004031E9 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 2_2_00404A21 | |
| Source: | Code function: | 2_2_706B1A98 | |
| Source: | Code function: | 2_2_04A314A8 | |
| Source: | Code function: | 2_2_04A320AE | |
| Source: | Code function: | 2_2_04A32897 | |
| Source: | Code function: | 2_2_04A3189B | |
| Source: | Code function: | 2_2_04A310F6 | |
| Source: | Code function: | 2_2_04A324DB | |
| Source: | Code function: | 2_2_04A32C37 | |
| Source: | Code function: | 2_2_04A3143B | |
| Source: | Code function: | 2_2_04A31800 | |
| Source: | Code function: | 2_2_04A32018 | |
| Source: | Code function: | 2_2_04A31C75 | |
| Source: | Code function: | 2_2_04A32441 | |
| Source: | Code function: | 2_2_04A32DA2 | |
| Source: | Code function: | 2_2_04A31D82 | |
| Source: | Code function: | 2_2_04A3198B | |
| Source: | Code function: | 2_2_04A3318B | |
| Source: | Code function: | 2_2_04A3218A | |
| Source: | Code function: | 2_2_04A321E8 | |
| Source: | Code function: | 2_2_04A319F6 | |
| Source: | Code function: | 2_2_04A315D0 | |
| Source: | Code function: | 2_2_04A32D30 | |
| Source: | Code function: | 2_2_04A3153A | |
| Source: | Code function: | 2_2_04A32909 | |
| Source: | Code function: | 2_2_04A31D0C | |
| Source: | Code function: | 2_2_04A3191C | |
| Source: | Code function: | 2_2_04A3211C | |
| Source: | Code function: | 2_2_04A3296F | |
| Source: | Code function: | 2_2_04A3116E | |
| Source: | Code function: | 2_2_04A32552 | |
| Source: | Code function: | 2_2_04A31AA9 | |
| Source: | Code function: | 2_2_04A316B3 | |
| Source: | Code function: | 2_2_04A30E92 | |
| Source: | Code function: | 2_2_04A32E97 | |
| Source: | Code function: | 2_2_04A3269B | |
| Source: | Code function: | 2_2_04A30E9A | |
| Source: | Code function: | 2_2_04A326FB | |
| Source: | Code function: | 2_2_04A312DA | |
| Source: | Code function: | 2_2_04A32A20 | |
| Source: | Code function: | 2_2_04A3162C | |
| Source: | Code function: | 2_2_04A3123F | |
| Source: | Code function: | 2_2_04A32A08 | |
| Source: | Code function: | 2_2_04A32E1D | |
| Source: | Code function: | 2_2_04A3261D | |
| Source: | Code function: | 2_2_04A32260 | |
| Source: | Code function: | 2_2_04A31E6F | |
| Source: | Code function: | 2_2_04A30E44 | |
| Source: | Code function: | 2_2_04A31A4D | |
| Source: | Code function: | 2_2_04A323B2 | |
| Source: | Code function: | 2_2_04A3178C | |
| Source: | Code function: | 2_2_04A32B94 | |
| Source: | Code function: | 2_2_04A31BE1 | |
| Source: | Code function: | 2_2_04A32FDA | |
| Source: | Code function: | 2_2_04A31336 | |
| Source: | Code function: | 2_2_04A32F3F | |
| Source: | Code function: | 2_2_04A3233C | |
| Source: | Code function: | 2_2_04A32B01 | |
| Source: | Code function: | 2_2_04A31B0F | |
| Source: | Code function: | 2_2_04A31718 | |
| Source: | Code function: | 2_2_04A31B71 | |
| Source: | Code function: | 2_2_04A31F75 | |
| Source: | Code function: | 4_2_00631C75 | |
| Source: | Code function: | 4_2_00632441 | |
| Source: | Code function: | 4_2_00632C37 | |
| Source: | Code function: | 4_2_0063143B | |
| Source: | Code function: | 4_2_00631800 | |
| Source: | Code function: | 4_2_00632018 | |
| Source: | Code function: | 4_2_006310F6 | |
| Source: | Code function: | 4_2_006324DB | |
| Source: | Code function: | 4_2_006314A8 | |
| Source: | Code function: | 4_2_006320AE | |
| Source: | Code function: | 4_2_00632897 | |
| Source: | Code function: | 4_2_0063189B | |
| Source: | Code function: | 4_2_0063296F | |
| Source: | Code function: | 4_2_0063116E | |
| Source: | Code function: | 4_2_00632552 | |
| Source: | Code function: | 4_2_00632D30 | |
| Source: | Code function: | 4_2_0063153A | |
| Source: | Code function: | 4_2_00632909 | |
| Source: | Code function: | 4_2_00631D0C | |
| Source: | Code function: | 4_2_0063191C | |
| Source: | Code function: | 4_2_0063211C | |
| Source: | Code function: | 4_2_006321E8 | |
| Source: | Code function: | 4_2_006319F6 | |
| Source: | Code function: | 4_2_006315D0 | |
| Source: | Code function: | 4_2_00632DA2 | |
| Source: | Code function: | 4_2_00631D82 | |
| Source: | Code function: | 4_2_0063198B | |
| Source: | Code function: | 4_2_0063318B | |
| Source: | Code function: | 4_2_0063218A | |
| Source: | Code function: | 4_2_00632260 | |
| Source: | Code function: | 4_2_00631E6F | |
| Source: | Code function: | 4_2_00630E44 | |
| Source: | Code function: | 4_2_00631A4D | |
| Source: | Code function: | 4_2_00632A20 | |
| Source: | Code function: | 4_2_0063162C | |
| Source: | Code function: | 4_2_0063123F | |
| Source: | Code function: | 4_2_00632A08 | |
| Source: | Code function: | 4_2_00632E1D | |
| Source: | Code function: | 4_2_0063261D | |
| Source: | Code function: | 4_2_006326FB | |
| Source: | Code function: | 4_2_006312DA | |
| Source: | Code function: | 4_2_00631AA9 | |
| Source: | Code function: | 4_2_006316B3 | |
| Source: | Code function: | 4_2_00630E92 | |
| Source: | Code function: | 4_2_00632E97 | |
| Source: | Code function: | 4_2_0063269B | |
| Source: | Code function: | 4_2_00630E9A | |
| Source: | Code function: | 4_2_00631B71 | |
| Source: | Code function: | 4_2_00631F75 | |
| Source: | Code function: | 4_2_00631336 | |
| Source: | Code function: | 4_2_00632F3F | |
| Source: | Code function: | 4_2_0063233C | |
| Source: | Code function: | 4_2_00632B01 | |
| Source: | Code function: | 4_2_00631B0F | |
| Source: | Code function: | 4_2_00631718 | |
| Source: | Code function: | 4_2_00631BE1 | |
| Source: | Code function: | 4_2_00632FDA | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Code function: | 2_2_004031E9 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | Code function: | 2_2_004020D1 | |
| Source: | File read: | Jump to behavior | ||
| Source: | Code function: | 2_2_004044AE | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 2_2_706B2F4E | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A388DD | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A394F1 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A364DD | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A3642D | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_04A36C51 | |
| Source: | Code function: | 2_2_04A34799 | |
| Source: | Code function: | 2_2_706B1A98 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Code function: | 2_2_00405745 | |
| Source: | Code function: | 2_2_004026FE | |
| Source: | Code function: | 2_2_00406280 | |
| Source: | API call chain: | graph_2-13223 | ||
| Source: | API call chain: | graph_2-13228 | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 2_2_706B1A98 | |
| Source: | Code function: | 2_2_00403B48 | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 2_2_004031E9 | |
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Access Token Manipulation | 1 Masquerading | OS Credential Dumping | 21 Security Software Discovery | Remote Services | 1 Archive Collected Data | Exfiltration Over Other Network Medium | 1 Encrypted Channel | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | 1 System Shutdown/Reboot |
| Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 111 Process Injection | 11 Virtualization/Sandbox Evasion | LSASS Memory | 11 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Clipboard Data | Exfiltration Over Bluetooth | 3 Ingress Tool Transfer | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | 1 DLL Side-Loading | 1 Access Token Manipulation | Security Account Manager | 3 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | 2 Non-Application Layer Protocol | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | 111 Process Injection | NTDS | 3 System Information Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | 12 Application Layer Protocol | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | 1 DLL Side-Loading | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | ReversingLabs |
| Source | Detection | Scanner | Label | Link | Download |
|---|---|---|---|---|---|
| 100% | Avira | HEUR/AGEN.1223491 | Download File | ||
| 100% | Avira | HEUR/AGEN.1223491 | Download File |
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware |
⊘No contacted domains info
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 37.139.128.83 | unknown | Germany | 10753 | LVLT-10753US | false |
| Joe Sandbox Version: | 37.0.0 Beryl |
| Analysis ID: | 830512 |
| Start date and time: | 2023-03-20 13:11:48 +01:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 17m 48s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301 |
| Number of analysed new started processes analysed: | 18 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample file name: | download.exe |
| Detection: | MAL |
| Classification: | mal76.troj.evad.winEXE@4/5@0/1 |
| EGA Information: |
|
| HDC Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
- Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, client.wns.windows.com, fs.microsoft.com, login.live.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, wdcp.microsoft.com
- Execution Graph export aborted for target CasPol.exe, PID 924 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtDeviceIoControlFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37.139.128.83 | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| LVLT-10753US | Get hash | malicious | SmokeLoader | Browse |
| |
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | Lokibot | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | Lokibot | Browse |
| ||
| Get hash | malicious | Lokibot | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Cryptbot | Browse |
| ||
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Cryptbot | Browse |
| ||
| Get hash | malicious | Cryptbot | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nse224D.tmp\System.dll | Get hash | malicious | Nanocore, GuLoader | Browse | ||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader, Remcos | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | AveMaria, GuLoader, UACMe | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | NanoCore, GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | AveMaria, GuLoader, UACMe | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader, Remcos | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | AveMaria, GuLoader, UACMe | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | NanoCore, GuLoader | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | GuLoader | Browse |
| Process: | C:\Users\user\Desktop\download.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11776 |
| Entropy (8bit): | 5.825582780706362 |
| Encrypted: | false |
| SSDEEP: | 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4 |
| MD5: | FBE295E5A1ACFBD0A6271898F885FE6A |
| SHA1: | D6D205922E61635472EFB13C2BB92C9AC6CB96DA |
| SHA-256: | A1390A78533C47E55CC364E97AF431117126D04A7FAED49390210EA3E89DD0E1 |
| SHA-512: | 2CB596971E504EAF1CE8E3F09719EBFB3F6234CEA5CA7B0D33EC7500832FF4B97EC2BBE15A1FBF7E6A5B02C59DB824092B9562CD8991F4D027FEAB6FD3177B06 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\download.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 310762 |
| Entropy (8bit): | 7.153872132508062 |
| Encrypted: | false |
| SSDEEP: | 6144:gjumg/DuSWsGx6RZLOMqkcjpwn2+3VJInGwhTFLI:gjumgbhWsGWZ+kcj2n2OJInJhTS |
| MD5: | A1C8FEE704DB305175D7A96481B66C73 |
| SHA1: | F26BE75182187BB5AA73C170605CF171D62DC023 |
| SHA-256: | 004CC2CA7789AB32D71678F5174DFC0F8EF1BA70A457929037E8CE0E4FD625C2 |
| SHA-512: | 4F5865B975DDD54A7770D89A28ADD620C5A675225F8F7974E68A6173B33C6FCA853D98AD1E2B054147B2ACD6C810BF90A252C30034973AB08B9CBACD69E6B965 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\download.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 142071 |
| Entropy (8bit): | 7.998708530523099 |
| Encrypted: | true |
| SSDEEP: | 3072:NZcIfJJvbMxWCmEblH1ZC0+UM53+9I1dPg4kh89+08iFRbleoK:5DMxW4fz1e3+9Sg9Z1iFRleoK |
| MD5: | 2CB77C7D9E16C0EF410FA8BC1CC1185A |
| SHA1: | 0FCBA04A0B4B4563D62A073080E173590BEEBEDD |
| SHA-256: | A0BFB53FAD74C41F699F171902C1D6A0AC33A81963697A3F674234B2FF36203A |
| SHA-512: | 33FDB3488F9BF085D7CDA649984BAE271194ECB64B569B5BDB1D09DE48C5D5407D75CDC2EA1A59E8E199F821CE4DA5F101D0A7CAA44E544E78C8D8507B6BC751 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\download.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 178696 |
| Entropy (8bit): | 4.4006904456537335 |
| Encrypted: | false |
| SSDEEP: | 3072:A8kCKqgt37ZJvMQSOnMIomX6YZVG5dWCR7+nyadqLEzBUyQj2UGBOyj:CvM7yj |
| MD5: | 8AD3A9D8C3DDA9854C13D213D00A8DB8 |
| SHA1: | 74283E98F0426DFA7854CEEF9BA43217F39DAB36 |
| SHA-256: | DA07C1D13136E3BAABB9D0598AF99BCB48898BF5DBCA0F0477602BEA957198E9 |
| SHA-512: | C30CA6FA4A62A6383C15AB8B95CD88714AF5C3A63F7FC9C8F767FED18E295B885B765B630831F456D16DB5DA7AA037CA931FCB3F412AB95A8D5E46B1B44497CA |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Heize\microphone-sensitivity-low-symbolic.symbolic.png
Download File
| Process: | C:\Users\user\Desktop\download.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 291 |
| Entropy (8bit): | 6.913400639640828 |
| Encrypted: | false |
| SSDEEP: | 6:6v/lhPysSFX/Fd8cy2TY3594VW6yTpm/v4pRw+jGbcnFbp:6v/7yFvn8cGJkv3twD |
| MD5: | 303E1921A67BAE379BC4B36352F391AA |
| SHA1: | AB361F32C8F1811EC7DB6EB96DAD417753323DB4 |
| SHA-256: | 1FC1141E644151384931853426BD36B5293BCAFE380189515850B9CC8FF158D7 |
| SHA-512: | 0A355819B8EB530A30710D536CCF6F5AACA7E9050C7CA9F591E31DC8BCBCEFC83EC9EA5B1E3B9356D64A66B42D04A0DD504A97B7AFC6CA35E7CED23A82A74C93 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.546765550553085 |
| TrID: |
|
| File name: | download.exe |
| File size: | 680560 |
| MD5: | 064fa36da0c2ca360b0906cc5bfe67c6 |
| SHA1: | a6623c33cbd86bdaee063f897bea1692621494e5 |
| SHA256: | 6974c5051372213d0e90147660c4b21bfff238e20c6449acb19f1901bf4729c8 |
| SHA512: | 39845a084b66442a1eb114621df67fe6db88e758b4564b79c01eff6a1935dcaba4149f0d3c68e243258b7da5f3ce197a904e226f561a0dfc1377ff22419a6026 |
| SSDEEP: | 12288:Z4oLK6+zAX00AF1pOSJe3xbIvli343lKZwIcBRPgYxFz18+t9Z1kU:6PQ00AF1pOSJeBUyqKKrf318U9Z1z |
| TLSH: | F2E4F15A2B7AC815D065E9F85AE3C50D5C749E14183CABD25BB1283EEBFC2527B0F047 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............/...........s.../...............+.......Rich............................PE..L......\.................b....9.... |
 | |
| Icon Hash: | c4ccc6e6e4f6f640 |
| Entrypoint: | 0x4031e9 |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x5C157F01 [Sat Dec 15 22:24:01 2018 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 3abe302b6d9a1256e6a915429af4ffd2 |
| Signature Valid: | false |
| Signature Issuer: | CN=barket, OU="Biselg Halo Uvitinic ", E=Strammende@Kummerfuld.Kur, O=barket, L=Middleton, S=Tennessee, C=US |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | F856691DCF4BB6A788E55B70FE388011 |
| Thumbprint SHA-1: | 0C5E3286DBBB50FA720930F437DDBC472FF1EFDF |
| Thumbprint SHA-256: | 7BCC618A115B3494BA1A7F1A5EDFACF31559C85478D2F90A7916E2A476BCF411 |
| Serial: | 807C3D2B116DDE7C |
| Instruction |
|---|
| sub esp, 00000184h |
| push ebx |
| push esi |
| push edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [esp+18h], ebx |
| mov dword ptr [esp+10h], 0040A198h |
| mov dword ptr [esp+20h], ebx |
| mov byte ptr [esp+14h], 00000020h |
| call dword ptr [004080A0h] |
| call dword ptr [0040809Ch] |
| and eax, BFFFFFFFh |
| cmp ax, 00000006h |
| mov dword ptr [007A2F4Ch], eax |
| je 00007FBDE865E5C3h |
| push ebx |
| call 00007FBDE866169Ah |
| cmp eax, ebx |
| je 00007FBDE865E5B9h |
| push 00000C00h |
| call eax |
| mov esi, 00408298h |
| push esi |
| call 00007FBDE8661616h |
| push esi |
| call dword ptr [00408098h] |
| lea esi, dword ptr [esi+eax+01h] |
| cmp byte ptr [esi], bl |
| jne 00007FBDE865E59Dh |
| push 0000000Ah |
| call 00007FBDE866166Eh |
| push 00000008h |
| call 00007FBDE8661667h |
| push 00000006h |
| mov dword ptr [007A2F44h], eax |
| call 00007FBDE866165Bh |
| cmp eax, ebx |
| je 00007FBDE865E5C1h |
| push 0000001Eh |
| call eax |
| test eax, eax |
| je 00007FBDE865E5B9h |
| or byte ptr [007A2F4Fh], 00000040h |
| push ebp |
| call dword ptr [00408044h] |
| push ebx |
| call dword ptr [00408288h] |
| mov dword ptr [007A3018h], eax |
| push ebx |
| lea eax, dword ptr [esp+38h] |
| push 00000160h |
| push eax |
| push ebx |
| push 0079E500h |
| call dword ptr [00408178h] |
| push 0040A188h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8430 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x3c7000 | 0x37c28 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0xa4d40 | 0x1530 | .data |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x8000 | 0x298 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6068 | 0x6200 | False | 0.671875 | data | 6.450713900012796 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x8000 | 0x1250 | 0x1400 | False | 0.430078125 | data | 5.041636133183931 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xa000 | 0x399058 | 0x400 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x3a4000 | 0x23000 | 0x0 | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x3c7000 | 0x37c28 | 0x37e00 | False | 0.4934109340044743 | data | 6.083319493650987 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country |
|---|---|---|---|---|---|
| RT_ICON | 0x3c7460 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States |
| RT_ICON | 0x3d7c88 | 0xd177 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States |
| RT_ICON | 0x3e4e00 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 38016 | English | United States |
| RT_ICON | 0x3ee2a8 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 21600 | English | United States |
| RT_ICON | 0x3f3730 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States |
| RT_ICON | 0x3f7958 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States |
| RT_ICON | 0x3f9f00 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States |
| RT_ICON | 0x3fafa8 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | English | United States |
| RT_ICON | 0x3fbe50 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States |
| RT_ICON | 0x3fc7d8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | English | United States |
| RT_ICON | 0x3fd080 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 1152 | English | United States |
| RT_ICON | 0x3fd6e8 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | English | United States |
| RT_ICON | 0x3fdc50 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States |
| RT_ICON | 0x3fe0b8 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 512 | English | United States |
| RT_ICON | 0x3fe3a0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128 | English | United States |
| RT_DIALOG | 0x3fe4c8 | 0x100 | data | English | United States |
| RT_DIALOG | 0x3fe5c8 | 0x11c | data | English | United States |
| RT_DIALOG | 0x3fe6e8 | 0xc4 | data | English | United States |
| RT_DIALOG | 0x3fe7b0 | 0x60 | data | English | United States |
| RT_GROUP_ICON | 0x3fe810 | 0xd8 | data | English | United States |
| RT_MANIFEST | 0x3fe8e8 | 0x33e | XML 1.0 document, ASCII text, with very long lines (830), with no line terminators | English | United States |
| DLL | Import |
|---|---|
| KERNEL32.dll | GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetCurrentDirectoryA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA |
| USER32.dll | ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA |
| ADVAPI32.dll | AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA |
| COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
| ole32.dll | OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 20, 2023 13:16:46.897514105 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:46.916491985 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:46.916826963 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:46.917243958 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:46.943846941 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:46.943917990 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:46.943964958 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:46.944006920 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:46.944037914 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:46.944081068 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:46.944143057 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:46.944204092 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:52.480920076 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:52.481168032 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:56.963512897 CET | 49792 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:56.963851929 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:56.981890917 CET | 80 | 49792 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:56.981976986 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:56.982162952 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:56.982340097 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:57.030054092 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:57.030136108 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:57.030189991 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:57.030237913 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:57.030291080 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:16:57.030379057 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:57.030380011 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:16:57.030443907 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:02.530766964 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:02.531013012 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.039050102 CET | 49795 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.039249897 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.057694912 CET | 80 | 49795 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:07.057790995 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:07.058085918 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.058161974 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.129527092 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:07.129926920 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.143343925 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:07.143439054 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:07.143497944 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:07.143510103 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.143595934 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:07.143606901 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.143656015 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:07.143703938 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:12.658093929 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:12.658453941 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:17.161452055 CET | 49798 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:17.161731958 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:17.179919958 CET | 80 | 49798 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:17.179985046 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:17.180273056 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:17.180488110 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:17.208664894 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:17.208734035 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:17.208784103 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:17.208827019 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:17.208869934 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:17.208889008 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:17.208889961 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:17.208966970 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:22.709000111 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:22.709415913 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.221820116 CET | 49800 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.222153902 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.239955902 CET | 80 | 49800 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.240132093 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.240246058 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.240505934 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.312999010 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.319519997 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.319586039 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.319698095 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.319760084 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.336045980 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.336110115 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.336155891 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:27.336225986 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:27.336298943 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:32.872137070 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:32.872304916 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.344167948 CET | 49801 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.344499111 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.362550020 CET | 80 | 49801 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:37.362641096 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:37.362831116 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.362966061 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.437429905 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:37.437498093 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:37.437544107 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:37.437587023 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:37.437632084 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:37.437645912 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.437716961 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.437817097 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:37.437818050 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:42.944545031 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:42.945274115 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:47.451338053 CET | 49804 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:47.451711893 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:47.469196081 CET | 80 | 49804 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:47.469358921 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:47.469532013 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:47.469768047 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:47.492672920 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:47.492774963 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:47.492829084 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:47.492837906 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:47.492846966 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:47.492887974 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:47.492985964 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:47.492985964 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:53.016680002 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:53.017091990 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:57.511610985 CET | 49805 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:57.511977911 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:57.529975891 CET | 80 | 49805 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:57.530036926 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:57.530306101 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:57.530489922 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:57.574198008 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:57.574271917 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:57.574321985 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:57.574364901 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:57.574408054 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:17:57.574467897 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:57.574534893 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:17:57.574613094 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:03.079468966 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:03.079658031 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:07.587513924 CET | 49806 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:07.590075970 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:07.605890989 CET | 80 | 49806 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:07.608428955 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:07.608625889 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:07.608877897 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:07.643163919 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:07.643179893 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:07.643299103 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:07.643312931 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:07.643421888 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:07.643440962 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:07.643440962 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:08.001169920 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:08.001374006 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:13.153027058 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:13.153261900 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:18.009469986 CET | 49810 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:18.009751081 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:18.028038025 CET | 80 | 49810 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:18.028105974 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:18.028309107 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:18.028491020 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:18.062808990 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:18.062891960 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:18.062947989 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:18.062997103 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:18.063051939 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:18.063137054 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:18.063137054 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:18.063220978 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:23.602072954 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:23.602298975 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:28.068234921 CET | 49811 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:28.068592072 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:28.086720943 CET | 80 | 49811 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:28.086791039 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:28.087094069 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:28.087193966 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:28.117830992 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:28.117913008 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:28.117969036 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:28.118019104 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:28.118046999 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:28.118074894 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:28.118171930 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:28.118220091 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:33.631720066 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:33.632379055 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:36.845438957 CET | 49812 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:36.863487959 CET | 80 | 49812 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:38.130460024 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:38.148802996 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:38.149136066 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:38.149235964 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:38.178752899 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:38.178833008 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:38.178886890 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:38.178935051 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:38.178965092 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:38.178988934 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:38.179054976 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:38.179114103 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:38.179160118 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:43.694008112 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:43.694276094 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:48.188818932 CET | 49814 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:48.189171076 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:48.207257032 CET | 80 | 49814 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:48.207386017 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:48.207638979 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:48.207734108 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:48.283617020 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:48.283715010 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:48.283776999 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:48.283837080 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:48.283891916 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:48.283987999 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:48.283987999 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:48.284074068 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:53.797794104 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:53.798151016 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.295320034 CET | 49816 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.295567036 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.314063072 CET | 80 | 49816 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:58.314151049 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:58.314477921 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.314579010 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.372782946 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:58.372881889 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:58.372941971 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:58.372997999 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:58.372993946 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.372993946 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.373060942 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:18:58.373205900 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:18:58.373207092 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:03.899411917 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:03.899653912 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:08.386692047 CET | 49817 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:08.387037992 CET | 49819 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:08.404649019 CET | 80 | 49817 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:08.404835939 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:08.405142069 CET | 49819 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:08.405410051 CET | 49819 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:08.439033985 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:08.439058065 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:08.439074993 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:08.439090967 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:08.439105988 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:08.439321995 CET | 49819 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:08.439321995 CET | 49819 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:13.954207897 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:13.954555035 CET | 49819 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:18.446949959 CET | 49819 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:18.447367907 CET | 49820 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:18.465378046 CET | 80 | 49819 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:18.465441942 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:18.465748072 CET | 49820 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:18.465970039 CET | 49820 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:18.525351048 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:18.525393963 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:18.525423050 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:18.525453091 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:18.525480986 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:18.525643110 CET | 49820 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:18.525769949 CET | 49820 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:24.026876926 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:24.027112007 CET | 49820 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.539459944 CET | 49820 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.539709091 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.558087111 CET | 80 | 49820 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:28.558162928 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:28.558506966 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.558624983 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.602679014 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:28.602756977 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:28.602807999 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:28.602854967 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:28.602905989 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:28.602998018 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.602998018 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.602998018 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:28.603095055 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:34.110204935 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:34.110419035 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.614507914 CET | 49821 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.614713907 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.632922888 CET | 80 | 49821 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:38.632985115 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:38.633246899 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.633337021 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.664674044 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:38.664743900 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:38.664789915 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:38.664835930 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:38.664845943 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.664896965 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.664910078 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:38.664978981 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:38.665150881 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:44.180115938 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:44.180349112 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.674999952 CET | 49823 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.678936958 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.693487883 CET | 80 | 49823 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:48.697426081 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:48.697638035 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.697762966 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.783301115 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:48.783382893 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:48.783437967 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:48.783482075 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.783518076 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:48.783539057 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.783611059 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:48.783668041 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.783735037 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:48.783792019 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:54.306735039 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:54.307104111 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:58.797430992 CET | 49824 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:58.797709942 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:58.815881968 CET | 80 | 49824 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:58.815943003 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:58.816267967 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:58.816569090 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:58.909148932 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:58.909228086 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:58.909280062 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:58.909333944 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:58.909383059 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:19:58.909467936 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:58.909467936 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:19:58.909666061 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:04.434014082 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:04.434355021 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:08.920147896 CET | 49825 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:08.920535088 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:08.938443899 CET | 80 | 49825 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:08.938505888 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:08.938694954 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:08.938875914 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:08.962862968 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:08.962925911 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:08.962971926 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:08.963013887 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:08.963059902 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:08.963140965 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:08.963140965 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:08.963210106 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:14.464277029 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:14.464648008 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:18.981542110 CET | 49827 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:18.981937885 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:18.999458075 CET | 80 | 49827 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:18.999727011 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:18.999917984 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:19.000097990 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:19.051856041 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:19.051923037 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:19.051974058 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:19.052016973 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:19.052059889 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:19.052081108 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:19.052082062 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:19.052082062 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:19.052217960 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:24.569574118 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:24.569962978 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:26.899542093 CET | 49829 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:26.917967081 CET | 80 | 49829 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:29.057013988 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:29.075489044 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:29.075661898 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:29.075845957 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:29.104176044 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:29.104244947 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:29.104290962 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:29.104368925 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:29.104403019 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:29.104415894 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:29.104486942 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:29.104532003 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:34.616930008 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:34.617865086 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.116533041 CET | 49830 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.120007992 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.134943962 CET | 80 | 49830 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:39.138489008 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:39.138756990 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.138921976 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.227524042 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:39.227592945 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:39.227638960 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:39.227682114 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:39.227729082 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:39.227725983 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.227799892 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.227801085 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.227801085 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:39.227941990 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:44.725275040 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:44.725593090 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:49.239451885 CET | 49832 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:49.239681959 CET | 49833 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:49.257570982 CET | 80 | 49832 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:49.257591009 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:49.257957935 CET | 49833 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:49.257998943 CET | 49833 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:49.293009043 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:49.293040991 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:49.293061972 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:49.293082952 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:49.293103933 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:49.293296099 CET | 49833 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:54.821466923 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:54.821705103 CET | 49833 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:59.300029039 CET | 49833 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:59.300364971 CET | 49834 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:59.318515062 CET | 80 | 49833 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:59.318587065 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:59.318790913 CET | 49834 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:59.318969011 CET | 49834 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:59.346731901 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:59.346787930 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:59.346818924 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:59.346847057 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:59.346941948 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:20:59.347045898 CET | 49834 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:20:59.347096920 CET | 49834 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:04.875719070 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:04.876426935 CET | 49834 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:09.360625029 CET | 49834 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:09.360910892 CET | 49836 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:09.378762007 CET | 80 | 49834 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:09.378942013 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:09.379074097 CET | 49836 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:09.379271984 CET | 49836 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:09.426351070 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:09.426366091 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:09.426376104 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:09.426386118 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:09.426542997 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:09.426860094 CET | 49836 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:14.938492060 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:14.938873053 CET | 49836 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.435759068 CET | 49836 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.436098099 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.454015017 CET | 80 | 49836 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:19.454085112 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:19.454273939 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.454461098 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.535763979 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:19.535883904 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:19.535974026 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:19.535973072 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.536031961 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.536063910 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:19.536145926 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:19.536252022 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:19.536252022 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:25.051575899 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:25.051752090 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:29.543023109 CET | 49837 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:29.543291092 CET | 49839 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:29.561393023 CET | 80 | 49837 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:29.561456919 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:29.561745882 CET | 49839 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:29.561847925 CET | 49839 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:29.604331970 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:29.604429007 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:29.604475975 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:29.604521036 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:29.604562044 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:29.604712963 CET | 49839 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:29.604712963 CET | 49839 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:35.125705004 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:35.125994921 CET | 49839 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:39.619085073 CET | 49839 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:39.619369984 CET | 49840 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:39.637676954 CET | 80 | 49839 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:39.637764931 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:39.638006926 CET | 49840 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:39.638174057 CET | 49840 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:39.703213930 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:39.703282118 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:39.703327894 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:39.703371048 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:39.703416109 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:39.703434944 CET | 49840 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:39.703632116 CET | 49840 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:45.211716890 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:45.212075949 CET | 49840 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.710959911 CET | 49840 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.711239100 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.729598999 CET | 80 | 49840 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:49.729675055 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:49.729978085 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.730093002 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.794543028 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:49.794631958 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:49.794694901 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:49.794749975 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:49.794775009 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.794809103 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:49.794872999 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.794936895 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:49.795154095 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:55.319158077 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:55.319613934 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:59.802663088 CET | 49841 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:59.802886963 CET | 49847 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:59.820452929 CET | 80 | 49841 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:59.820678949 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:59.820866108 CET | 49847 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:59.821090937 CET | 49847 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:59.854135990 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:59.854221106 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:59.854337931 CET | 49847 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:21:59.854341984 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:59.854352951 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:59.854388952 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:21:59.854656935 CET | 49847 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:05.354058981 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:05.354338884 CET | 49847 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:09.862337112 CET | 49847 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:09.862581968 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:09.880660057 CET | 80 | 49847 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:09.880744934 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:09.881028891 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:09.881185055 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:09.910502911 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:09.910592079 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:09.910655022 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:09.910712957 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:09.910772085 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:09.910778999 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:09.910851002 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:09.911010027 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:15.431065083 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:15.431443930 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:16.843944073 CET | 49851 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:16.862528086 CET | 80 | 49851 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:19.922751904 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:19.940938950 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:19.941251993 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:19.941399097 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:19.964976072 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:19.965059042 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:19.965203047 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:19.965223074 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:19.965253115 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:19.965310097 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:19.965333939 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:19.965394974 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:19.965429068 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:19.965554953 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:25.477260113 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:25.477605104 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:29.982990980 CET | 49852 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:29.983200073 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:30.001508951 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:30.001580954 CET | 80 | 49852 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:30.001928091 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:30.002024889 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:30.059920073 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:30.060194016 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:30.073276997 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:30.073358059 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:30.073452950 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:30.073503971 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:30.073673964 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:30.073674917 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:36.062880993 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:36.063106060 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.091077089 CET | 49856 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.091398001 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.109183073 CET | 80 | 49856 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:40.109390020 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:40.109571934 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.109833956 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.143893003 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:40.143981934 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:40.144046068 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:40.144110918 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:40.144114017 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.144167900 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.144188881 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:40.144223928 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.144224882 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:40.144366026 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:45.657187939 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:45.657530069 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:50.150275946 CET | 49858 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:50.150636911 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:50.168243885 CET | 80 | 49858 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:51.164467096 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:51.183094025 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:51.183523893 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:51.183643103 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:51.264005899 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:51.264113903 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:51.264184952 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:51.264250994 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:51.264313936 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:51.264313936 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:51.264365911 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:51.264419079 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:51.264568090 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:22:56.783986092 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:22:56.784223080 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:01.273238897 CET | 49859 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:01.273616076 CET | 49862 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:01.291487932 CET | 80 | 49859 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.291758060 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.291977882 CET | 49862 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:01.292118073 CET | 49862 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:01.359757900 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.376612902 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.376636028 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.376651049 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.376665115 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.376679897 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:01.376837969 CET | 49862 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:06.891621113 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:06.892045021 CET | 49862 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:11.380074024 CET | 49862 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:11.384370089 CET | 49863 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:11.398274899 CET | 80 | 49862 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:11.402559996 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:11.402971983 CET | 49863 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:11.403112888 CET | 49863 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:11.436139107 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:11.436197042 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:11.436214924 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:11.436230898 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:11.436245918 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:11.436404943 CET | 49863 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:16.934752941 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:16.934954882 CET | 49863 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:21.440457106 CET | 49863 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:21.440877914 CET | 49864 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:21.458837986 CET | 80 | 49863 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:21.458900928 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:21.459194899 CET | 49864 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:21.459638119 CET | 49864 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:21.510338068 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:21.510406017 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:21.510452032 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:21.510493040 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:21.510539055 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:21.510623932 CET | 49864 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:21.510687113 CET | 49864 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:27.031553984 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:27.031851053 CET | 49864 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:31.516762018 CET | 49864 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:31.517106056 CET | 49867 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:31.534893036 CET | 80 | 49864 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:31.535064936 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:31.535252094 CET | 49867 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:31.535437107 CET | 49867 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:31.623294115 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:31.623338938 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:31.623369932 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:31.623399019 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:31.623429060 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:31.623591900 CET | 49867 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:31.623591900 CET | 49867 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:37.159677982 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:37.160043001 CET | 49867 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.639292955 CET | 49867 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.639592886 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.657773972 CET | 80 | 49867 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:41.657840014 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:41.658066034 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.658135891 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.731969118 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:41.732053041 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:41.732215881 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.744688988 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:41.744771004 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:41.744826078 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:41.744853020 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.744945049 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:41.745130062 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:47.262861013 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:47.263067007 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:51.763251066 CET | 49868 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:51.763552904 CET | 49869 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:51.781378984 CET | 80 | 49868 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:51.781577110 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:51.781733990 CET | 49869 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:51.781950951 CET | 49869 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:51.810120106 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:51.810159922 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:51.810324907 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:51.810340881 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:51.810353994 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:51.810520887 CET | 49869 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:23:57.298580885 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:23:57.298773050 CET | 49869 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:01.824183941 CET | 49869 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:01.824743032 CET | 49872 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:01.842614889 CET | 80 | 49869 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:01.842983961 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:01.843725920 CET | 49872 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:01.843806982 CET | 49872 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:01.929733038 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:01.929783106 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:01.929805994 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:01.929902077 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:01.929923058 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:01.930332899 CET | 49872 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:07.453782082 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:07.454061031 CET | 49872 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:11.945295095 CET | 49872 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:11.945919991 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:11.963943958 CET | 80 | 49872 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:11.964046955 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:11.964363098 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:11.964451075 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:12.030263901 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:12.030352116 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:12.030412912 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:12.030468941 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:12.030525923 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:12.030550957 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:12.030649900 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:12.030718088 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:17.520947933 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:17.521183014 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:22.036602974 CET | 49873 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:22.037225962 CET | 49874 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:22.054646969 CET | 80 | 49873 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:22.055212021 CET | 80 | 49874 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:22.055437088 CET | 49874 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:22.055651903 CET | 49874 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:22.127638102 CET | 80 | 49874 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:22.127703905 CET | 80 | 49874 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:22.127751112 CET | 80 | 49874 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:22.127794027 CET | 80 | 49874 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:22.127821922 CET | 49874 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:22.127840042 CET | 80 | 49874 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:22.127919912 CET | 49874 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:22.127959967 CET | 49874 | 80 | 192.168.11.20 | 37.139.128.83 |
| Mar 20, 2023 13:24:27.661990881 CET | 80 | 49874 | 37.139.128.83 | 192.168.11.20 |
| Mar 20, 2023 13:24:27.662184954 CET | 49874 | 80 | 192.168.11.20 | 37.139.128.83 |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.11.20 | 49792 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:16:46.917243958 CET | 158 | OUT | |
| Mar 20, 2023 13:16:46.943846941 CET | 159 | IN | |
| Mar 20, 2023 13:16:46.943917990 CET | 159 | IN | |
| Mar 20, 2023 13:16:46.943964958 CET | 160 | IN | |
| Mar 20, 2023 13:16:46.944006920 CET | 160 | IN | |
| Mar 20, 2023 13:16:46.944081068 CET | 160 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 1 | 192.168.11.20 | 49795 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:16:56.982340097 CET | 169 | OUT | |
| Mar 20, 2023 13:16:57.030054092 CET | 170 | IN | |
| Mar 20, 2023 13:16:57.030136108 CET | 170 | IN | |
| Mar 20, 2023 13:16:57.030189991 CET | 171 | IN | |
| Mar 20, 2023 13:16:57.030237913 CET | 171 | IN | |
| Mar 20, 2023 13:16:57.030291080 CET | 171 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 10 | 192.168.11.20 | 49812 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:18:28.087193966 CET | 234 | OUT | |
| Mar 20, 2023 13:18:28.117830992 CET | 234 | IN | |
| Mar 20, 2023 13:18:28.117913008 CET | 235 | IN | |
| Mar 20, 2023 13:18:28.117969036 CET | 235 | IN | |
| Mar 20, 2023 13:18:28.118019104 CET | 235 | IN | |
| Mar 20, 2023 13:18:28.118074894 CET | 235 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 11 | 192.168.11.20 | 49814 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:18:38.149235964 CET | 243 | OUT | |
| Mar 20, 2023 13:18:38.178752899 CET | 243 | IN | |
| Mar 20, 2023 13:18:38.178833008 CET | 244 | IN | |
| Mar 20, 2023 13:18:38.178886890 CET | 244 | IN | |
| Mar 20, 2023 13:18:38.178935051 CET | 244 | IN | |
| Mar 20, 2023 13:18:38.178988934 CET | 244 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 12 | 192.168.11.20 | 49816 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:18:48.207734108 CET | 252 | OUT | |
| Mar 20, 2023 13:18:48.283617020 CET | 253 | IN | |
| Mar 20, 2023 13:18:48.283715010 CET | 253 | IN | |
| Mar 20, 2023 13:18:48.283776999 CET | 253 | IN | |
| Mar 20, 2023 13:18:48.283837080 CET | 254 | IN | |
| Mar 20, 2023 13:18:48.283891916 CET | 254 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 13 | 192.168.11.20 | 49817 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:18:58.314579010 CET | 254 | OUT | |
| Mar 20, 2023 13:18:58.372782946 CET | 255 | IN | |
| Mar 20, 2023 13:18:58.372881889 CET | 256 | IN | |
| Mar 20, 2023 13:18:58.372941971 CET | 256 | IN | |
| Mar 20, 2023 13:18:58.372997999 CET | 256 | IN | |
| Mar 20, 2023 13:18:58.373060942 CET | 256 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 14 | 192.168.11.20 | 49819 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:19:08.405410051 CET | 264 | OUT | |
| Mar 20, 2023 13:19:08.439033985 CET | 264 | IN | |
| Mar 20, 2023 13:19:08.439058065 CET | 265 | IN | |
| Mar 20, 2023 13:19:08.439074993 CET | 265 | IN | |
| Mar 20, 2023 13:19:08.439090967 CET | 265 | IN | |
| Mar 20, 2023 13:19:08.439105988 CET | 265 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 15 | 192.168.11.20 | 49820 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:19:18.465970039 CET | 266 | OUT | |
| Mar 20, 2023 13:19:18.525351048 CET | 267 | IN | |
| Mar 20, 2023 13:19:18.525393963 CET | 267 | IN | |
| Mar 20, 2023 13:19:18.525423050 CET | 267 | IN | |
| Mar 20, 2023 13:19:18.525453091 CET | 268 | IN | |
| Mar 20, 2023 13:19:18.525480986 CET | 268 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 16 | 192.168.11.20 | 49821 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:19:28.558624983 CET | 268 | OUT | |
| Mar 20, 2023 13:19:28.602679014 CET | 269 | IN | |
| Mar 20, 2023 13:19:28.602756977 CET | 269 | IN | |
| Mar 20, 2023 13:19:28.602807999 CET | 270 | IN | |
| Mar 20, 2023 13:19:28.602854967 CET | 270 | IN | |
| Mar 20, 2023 13:19:28.602905989 CET | 270 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 17 | 192.168.11.20 | 49823 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:19:38.633337021 CET | 278 | OUT | |
| Mar 20, 2023 13:19:38.664674044 CET | 278 | IN | |
| Mar 20, 2023 13:19:38.664743900 CET | 279 | IN | |
| Mar 20, 2023 13:19:38.664789915 CET | 279 | IN | |
| Mar 20, 2023 13:19:38.664835930 CET | 279 | IN | |
| Mar 20, 2023 13:19:38.664910078 CET | 279 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 18 | 192.168.11.20 | 49824 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:19:48.697762966 CET | 280 | OUT | |
| Mar 20, 2023 13:19:48.783301115 CET | 281 | IN | |
| Mar 20, 2023 13:19:48.783382893 CET | 281 | IN | |
| Mar 20, 2023 13:19:48.783437967 CET | 282 | IN | |
| Mar 20, 2023 13:19:48.783518076 CET | 282 | IN | |
| Mar 20, 2023 13:19:48.783611059 CET | 282 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 19 | 192.168.11.20 | 49825 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:19:58.816569090 CET | 283 | OUT | |
| Mar 20, 2023 13:19:58.909148932 CET | 283 | IN | |
| Mar 20, 2023 13:19:58.909228086 CET | 284 | IN | |
| Mar 20, 2023 13:19:58.909280062 CET | 284 | IN | |
| Mar 20, 2023 13:19:58.909333944 CET | 284 | IN | |
| Mar 20, 2023 13:19:58.909383059 CET | 284 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 2 | 192.168.11.20 | 49798 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:17:07.058161974 CET | 179 | OUT | |
| Mar 20, 2023 13:17:07.129527092 CET | 179 | IN | |
| Mar 20, 2023 13:17:07.143343925 CET | 180 | IN | |
| Mar 20, 2023 13:17:07.143439054 CET | 180 | IN | |
| Mar 20, 2023 13:17:07.143497944 CET | 180 | IN | |
| Mar 20, 2023 13:17:07.143595934 CET | 181 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 20 | 192.168.11.20 | 49827 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:20:08.938875914 CET | 292 | OUT | |
| Mar 20, 2023 13:20:08.962862968 CET | 292 | IN | |
| Mar 20, 2023 13:20:08.962925911 CET | 293 | IN | |
| Mar 20, 2023 13:20:08.962971926 CET | 293 | IN | |
| Mar 20, 2023 13:20:08.963013887 CET | 294 | IN | |
| Mar 20, 2023 13:20:08.963059902 CET | 294 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 21 | 192.168.11.20 | 49829 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:20:19.000097990 CET | 301 | OUT | |
| Mar 20, 2023 13:20:19.051856041 CET | 301 | IN | |
| Mar 20, 2023 13:20:19.051923037 CET | 302 | IN | |
| Mar 20, 2023 13:20:19.051974058 CET | 302 | IN | |
| Mar 20, 2023 13:20:19.052016973 CET | 303 | IN | |
| Mar 20, 2023 13:20:19.052059889 CET | 303 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 22 | 192.168.11.20 | 49830 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:20:29.075845957 CET | 303 | OUT | |
| Mar 20, 2023 13:20:29.104176044 CET | 304 | IN | |
| Mar 20, 2023 13:20:29.104244947 CET | 304 | IN | |
| Mar 20, 2023 13:20:29.104290962 CET | 305 | IN | |
| Mar 20, 2023 13:20:29.104368925 CET | 305 | IN | |
| Mar 20, 2023 13:20:29.104415894 CET | 305 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 23 | 192.168.11.20 | 49832 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:20:39.138921976 CET | 313 | OUT | |
| Mar 20, 2023 13:20:39.227524042 CET | 313 | IN | |
| Mar 20, 2023 13:20:39.227592945 CET | 314 | IN | |
| Mar 20, 2023 13:20:39.227638960 CET | 314 | IN | |
| Mar 20, 2023 13:20:39.227682114 CET | 314 | IN | |
| Mar 20, 2023 13:20:39.227729082 CET | 314 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 24 | 192.168.11.20 | 49833 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:20:49.257998943 CET | 315 | OUT | |
| Mar 20, 2023 13:20:49.293009043 CET | 316 | IN | |
| Mar 20, 2023 13:20:49.293040991 CET | 316 | IN | |
| Mar 20, 2023 13:20:49.293061972 CET | 317 | IN | |
| Mar 20, 2023 13:20:49.293082952 CET | 317 | IN | |
| Mar 20, 2023 13:20:49.293103933 CET | 317 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 25 | 192.168.11.20 | 49834 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:20:59.318969011 CET | 317 | OUT | |
| Mar 20, 2023 13:20:59.346731901 CET | 318 | IN | |
| Mar 20, 2023 13:20:59.346787930 CET | 319 | IN | |
| Mar 20, 2023 13:20:59.346818924 CET | 319 | IN | |
| Mar 20, 2023 13:20:59.346847057 CET | 319 | IN | |
| Mar 20, 2023 13:20:59.346941948 CET | 319 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 26 | 192.168.11.20 | 49836 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:21:09.379271984 CET | 327 | OUT | |
| Mar 20, 2023 13:21:09.426351070 CET | 327 | IN | |
| Mar 20, 2023 13:21:09.426366091 CET | 328 | IN | |
| Mar 20, 2023 13:21:09.426376104 CET | 328 | IN | |
| Mar 20, 2023 13:21:09.426386118 CET | 328 | IN | |
| Mar 20, 2023 13:21:09.426542997 CET | 328 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 27 | 192.168.11.20 | 49837 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:21:19.454461098 CET | 329 | OUT | |
| Mar 20, 2023 13:21:19.535763979 CET | 329 | IN | |
| Mar 20, 2023 13:21:19.535883904 CET | 330 | IN | |
| Mar 20, 2023 13:21:19.535974026 CET | 330 | IN | |
| Mar 20, 2023 13:21:19.536063910 CET | 331 | IN | |
| Mar 20, 2023 13:21:19.536145926 CET | 331 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 28 | 192.168.11.20 | 49839 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:21:29.561847925 CET | 332 | OUT | |
| Mar 20, 2023 13:21:29.604331970 CET | 339 | IN | |
| Mar 20, 2023 13:21:29.604429007 CET | 339 | IN | |
| Mar 20, 2023 13:21:29.604475975 CET | 339 | IN | |
| Mar 20, 2023 13:21:29.604521036 CET | 340 | IN | |
| Mar 20, 2023 13:21:29.604562044 CET | 340 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 29 | 192.168.11.20 | 49840 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:21:39.638174057 CET | 340 | OUT | |
| Mar 20, 2023 13:21:39.703213930 CET | 341 | IN | |
| Mar 20, 2023 13:21:39.703282118 CET | 341 | IN | |
| Mar 20, 2023 13:21:39.703327894 CET | 342 | IN | |
| Mar 20, 2023 13:21:39.703371048 CET | 342 | IN | |
| Mar 20, 2023 13:21:39.703416109 CET | 342 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 3 | 192.168.11.20 | 49800 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:17:17.180488110 CET | 188 | OUT | |
| Mar 20, 2023 13:17:17.208664894 CET | 188 | IN | |
| Mar 20, 2023 13:17:17.208734035 CET | 189 | IN | |
| Mar 20, 2023 13:17:17.208784103 CET | 189 | IN | |
| Mar 20, 2023 13:17:17.208827019 CET | 189 | IN | |
| Mar 20, 2023 13:17:17.208869934 CET | 190 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 30 | 192.168.11.20 | 49841 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:21:49.730093002 CET | 343 | OUT | |
| Mar 20, 2023 13:21:49.794543028 CET | 344 | IN | |
| Mar 20, 2023 13:21:49.794631958 CET | 344 | IN | |
| Mar 20, 2023 13:21:49.794694901 CET | 344 | IN | |
| Mar 20, 2023 13:21:49.794749975 CET | 345 | IN | |
| Mar 20, 2023 13:21:49.794809103 CET | 345 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 31 | 192.168.11.20 | 49847 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:21:59.821090937 CET | 400 | OUT | |
| Mar 20, 2023 13:21:59.854135990 CET | 400 | IN | |
| Mar 20, 2023 13:21:59.854221106 CET | 401 | IN | |
| Mar 20, 2023 13:21:59.854341984 CET | 401 | IN | |
| Mar 20, 2023 13:21:59.854352951 CET | 402 | IN | |
| Mar 20, 2023 13:21:59.854388952 CET | 402 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 32 | 192.168.11.20 | 49851 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:22:09.881185055 CET | 418 | OUT | |
| Mar 20, 2023 13:22:09.910502911 CET | 419 | IN | |
| Mar 20, 2023 13:22:09.910592079 CET | 419 | IN | |
| Mar 20, 2023 13:22:09.910655022 CET | 419 | IN | |
| Mar 20, 2023 13:22:09.910712957 CET | 420 | IN | |
| Mar 20, 2023 13:22:09.910772085 CET | 420 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 33 | 192.168.11.20 | 49852 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:22:19.941399097 CET | 421 | OUT | |
| Mar 20, 2023 13:22:19.964976072 CET | 421 | IN | |
| Mar 20, 2023 13:22:19.965059042 CET | 422 | IN | |
| Mar 20, 2023 13:22:19.965223074 CET | 422 | IN | |
| Mar 20, 2023 13:22:19.965310097 CET | 423 | IN | |
| Mar 20, 2023 13:22:19.965394974 CET | 423 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 34 | 192.168.11.20 | 49856 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:22:30.002024889 CET | 441 | OUT | |
| Mar 20, 2023 13:22:30.059920073 CET | 442 | IN | |
| Mar 20, 2023 13:22:30.073276997 CET | 442 | IN | |
| Mar 20, 2023 13:22:30.073358059 CET | 443 | IN | |
| Mar 20, 2023 13:22:30.073452950 CET | 443 | IN | |
| Mar 20, 2023 13:22:30.073503971 CET | 443 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 35 | 192.168.11.20 | 49858 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:22:40.109833956 CET | 462 | OUT | |
| Mar 20, 2023 13:22:40.143893003 CET | 463 | IN | |
| Mar 20, 2023 13:22:40.143981934 CET | 463 | IN | |
| Mar 20, 2023 13:22:40.144046068 CET | 464 | IN | |
| Mar 20, 2023 13:22:40.144110918 CET | 464 | IN | |
| Mar 20, 2023 13:22:40.144188881 CET | 464 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 36 | 192.168.11.20 | 49859 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:22:51.183643103 CET | 465 | OUT | |
| Mar 20, 2023 13:22:51.264005899 CET | 466 | IN | |
| Mar 20, 2023 13:22:51.264113903 CET | 466 | IN | |
| Mar 20, 2023 13:22:51.264184952 CET | 466 | IN | |
| Mar 20, 2023 13:22:51.264250994 CET | 467 | IN | |
| Mar 20, 2023 13:22:51.264365911 CET | 467 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 37 | 192.168.11.20 | 49862 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:23:01.292118073 CET | 492 | OUT | |
| Mar 20, 2023 13:23:01.376612902 CET | 493 | IN | |
| Mar 20, 2023 13:23:01.376636028 CET | 493 | IN | |
| Mar 20, 2023 13:23:01.376651049 CET | 494 | IN | |
| Mar 20, 2023 13:23:01.376665115 CET | 494 | IN | |
| Mar 20, 2023 13:23:01.376679897 CET | 494 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 38 | 192.168.11.20 | 49863 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:23:11.403112888 CET | 495 | OUT | |
| Mar 20, 2023 13:23:11.436139107 CET | 495 | IN | |
| Mar 20, 2023 13:23:11.436197042 CET | 496 | IN | |
| Mar 20, 2023 13:23:11.436214924 CET | 496 | IN | |
| Mar 20, 2023 13:23:11.436230898 CET | 496 | IN | |
| Mar 20, 2023 13:23:11.436245918 CET | 496 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 39 | 192.168.11.20 | 49864 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:23:21.459638119 CET | 497 | OUT | |
| Mar 20, 2023 13:23:21.510338068 CET | 498 | IN | |
| Mar 20, 2023 13:23:21.510406017 CET | 498 | IN | |
| Mar 20, 2023 13:23:21.510452032 CET | 499 | IN | |
| Mar 20, 2023 13:23:21.510493040 CET | 499 | IN | |
| Mar 20, 2023 13:23:21.510539055 CET | 499 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 4 | 192.168.11.20 | 49801 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:17:27.240505934 CET | 190 | OUT | |
| Mar 20, 2023 13:17:27.319519997 CET | 191 | IN | |
| Mar 20, 2023 13:17:27.319586039 CET | 191 | IN | |
| Mar 20, 2023 13:17:27.336045980 CET | 192 | IN | |
| Mar 20, 2023 13:17:27.336110115 CET | 192 | IN | |
| Mar 20, 2023 13:17:27.336155891 CET | 192 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 40 | 192.168.11.20 | 49867 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:23:31.535437107 CET | 524 | OUT | |
| Mar 20, 2023 13:23:31.623294115 CET | 525 | IN | |
| Mar 20, 2023 13:23:31.623338938 CET | 525 | IN | |
| Mar 20, 2023 13:23:31.623369932 CET | 526 | IN | |
| Mar 20, 2023 13:23:31.623399019 CET | 526 | IN | |
| Mar 20, 2023 13:23:31.623429060 CET | 526 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 41 | 192.168.11.20 | 49868 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:23:41.658135891 CET | 527 | OUT | |
| Mar 20, 2023 13:23:41.731969118 CET | 527 | IN | |
| Mar 20, 2023 13:23:41.732053041 CET | 528 | IN | |
| Mar 20, 2023 13:23:41.744688988 CET | 528 | IN | |
| Mar 20, 2023 13:23:41.744771004 CET | 528 | IN | |
| Mar 20, 2023 13:23:41.744826078 CET | 528 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 42 | 192.168.11.20 | 49869 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:23:51.781950951 CET | 529 | OUT | |
| Mar 20, 2023 13:23:51.810120106 CET | 530 | IN | |
| Mar 20, 2023 13:23:51.810159922 CET | 530 | IN | |
| Mar 20, 2023 13:23:51.810324907 CET | 530 | IN | |
| Mar 20, 2023 13:23:51.810340881 CET | 531 | IN | |
| Mar 20, 2023 13:23:51.810353994 CET | 531 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 43 | 192.168.11.20 | 49872 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:24:01.843806982 CET | 556 | OUT | |
| Mar 20, 2023 13:24:01.929733038 CET | 557 | IN | |
| Mar 20, 2023 13:24:01.929783106 CET | 557 | IN | |
| Mar 20, 2023 13:24:01.929805994 CET | 558 | IN | |
| Mar 20, 2023 13:24:01.929902077 CET | 558 | IN | |
| Mar 20, 2023 13:24:01.929923058 CET | 558 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 44 | 192.168.11.20 | 49873 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:24:11.964451075 CET | 559 | OUT | |
| Mar 20, 2023 13:24:12.030263901 CET | 559 | IN | |
| Mar 20, 2023 13:24:12.030352116 CET | 560 | IN | |
| Mar 20, 2023 13:24:12.030412912 CET | 560 | IN | |
| Mar 20, 2023 13:24:12.030468941 CET | 560 | IN | |
| Mar 20, 2023 13:24:12.030525923 CET | 560 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 45 | 192.168.11.20 | 49874 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:24:22.055651903 CET | 561 | OUT | |
| Mar 20, 2023 13:24:22.127638102 CET | 562 | IN | |
| Mar 20, 2023 13:24:22.127703905 CET | 562 | IN | |
| Mar 20, 2023 13:24:22.127751112 CET | 562 | IN | |
| Mar 20, 2023 13:24:22.127794027 CET | 563 | IN | |
| Mar 20, 2023 13:24:22.127840042 CET | 563 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 5 | 192.168.11.20 | 49804 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:17:37.362966061 CET | 207 | OUT | |
| Mar 20, 2023 13:17:37.437429905 CET | 207 | IN | |
| Mar 20, 2023 13:17:37.437498093 CET | 208 | IN | |
| Mar 20, 2023 13:17:37.437544107 CET | 208 | IN | |
| Mar 20, 2023 13:17:37.437587023 CET | 208 | IN | |
| Mar 20, 2023 13:17:37.437632084 CET | 208 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 6 | 192.168.11.20 | 49805 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:17:47.469768047 CET | 209 | OUT | |
| Mar 20, 2023 13:17:47.492672920 CET | 210 | IN | |
| Mar 20, 2023 13:17:47.492774963 CET | 210 | IN | |
| Mar 20, 2023 13:17:47.492829084 CET | 211 | IN | |
| Mar 20, 2023 13:17:47.492837906 CET | 211 | IN | |
| Mar 20, 2023 13:17:47.492846966 CET | 211 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 7 | 192.168.11.20 | 49806 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:17:57.530489922 CET | 212 | OUT | |
| Mar 20, 2023 13:17:57.574198008 CET | 213 | IN | |
| Mar 20, 2023 13:17:57.574271917 CET | 213 | IN | |
| Mar 20, 2023 13:17:57.574321985 CET | 213 | IN | |
| Mar 20, 2023 13:17:57.574364901 CET | 214 | IN | |
| Mar 20, 2023 13:17:57.574408054 CET | 214 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 8 | 192.168.11.20 | 49810 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:18:07.608877897 CET | 228 | OUT | |
| Mar 20, 2023 13:18:07.643163919 CET | 229 | IN | |
| Mar 20, 2023 13:18:07.643179893 CET | 229 | IN | |
| Mar 20, 2023 13:18:07.643299103 CET | 229 | IN | |
| Mar 20, 2023 13:18:07.643312931 CET | 229 | IN | |
| Mar 20, 2023 13:18:08.001169920 CET | 230 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 9 | 192.168.11.20 | 49811 | 37.139.128.83 | 80 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 20, 2023 13:18:18.028491020 CET | 231 | OUT | |
| Mar 20, 2023 13:18:18.062808990 CET | 232 | IN | |
| Mar 20, 2023 13:18:18.062891960 CET | 232 | IN | |
| Mar 20, 2023 13:18:18.062947989 CET | 232 | IN | |
| Mar 20, 2023 13:18:18.062997103 CET | 233 | IN | |
| Mar 20, 2023 13:18:18.063051939 CET | 233 | IN |
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 2 |
| Start time: | 13:15:59 |
| Start date: | 20/03/2023 |
| Path: | C:\Users\user\Desktop\download.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 680560 bytes |
| MD5 hash: | 064FA36DA0C2CA360B0906CC5BFE67C6 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Target ID: | 4 |
| Start time: | 13:16:37 |
| Start date: | 20/03/2023 |
| Path: | C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x10000 |
| File size: | 106496 bytes |
| MD5 hash: | 7BAE06CBE364BB42B8C34FCFB90E3EBD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | moderate |
| Target ID: | 5 |
| Start time: | 13:16:37 |
| Start date: | 20/03/2023 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7d7f70000 |
| File size: | 875008 bytes |
| MD5 hash: | 81CA40085FC75BABD2C91D18AA9FFA68 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Execution Graph
| Execution Coverage: | 7.3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 26.6% |
| Total number of Nodes: | 1005 |
| Total number of Limit Nodes: | 43 |
Graph
Function 004031E9 Relevance: 93.1, APIs: 32, Strings: 21, Instructions: 366stringcomfileCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 86% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004051E2 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 96% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 84% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 706B1A98 Relevance: 20.1, APIs: 13, Instructions: 571stringlibrarymemoryCOMMONCrypto
Download Yara Rule
| C-Code - Quality: 95% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405745 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159filestringCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 98% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 74% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004026FE Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| C-Code - Quality: 41% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004037AB Relevance: 49.2, APIs: 14, Strings: 14, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 96% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 80% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405F9F Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 199stringCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 72% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401759 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 61% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004050A4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00402003 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 60% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 73% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004062A7 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 95% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 94% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
| C-Code - Quality: 59% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004023D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
Download Yara Rule
| C-Code - Quality: 83% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405A03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
Download Yara Rule
| C-Code - Quality: 53% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 84% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 87% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405E64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
Download Yara Rule
| C-Code - Quality: 90% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040561C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 86% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 84% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| C-Code - Quality: 60% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401E2B Relevance: 3.0, APIs: 2, Instructions: 25COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405B16 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| C-Code - Quality: 68% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405AF1 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004055E7 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 706B29F8 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON
Download Yara Rule
| C-Code - Quality: 28% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004025CA Relevance: 1.6, APIs: 1, Instructions: 76COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
Download Yara Rule
| C-Code - Quality: 70% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| C-Code - Quality: 40% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004022FC Relevance: 1.5, APIs: 1, Instructions: 26COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405B8E Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405BBD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 706B28E1 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00402340 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401563 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00404068 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00404051 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040565F Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004031A1 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040403E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00404A21 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMONCrypto
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A323B2 Relevance: 27.9, Strings: 22, Instructions: 405COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004044AE Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON
Download Yara Rule
| C-Code - Quality: 78% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3116E Relevance: .7, Instructions: 679COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3123F Relevance: .7, Instructions: 672COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31336 Relevance: .7, Instructions: 671COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A320AE Relevance: .7, Instructions: 662COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3143B Relevance: .6, Instructions: 613COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A30E44 Relevance: .6, Instructions: 604COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A312DA Relevance: .6, Instructions: 601COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A316B3 Relevance: .6, Instructions: 581COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31C75 Relevance: .6, Instructions: 580COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3153A Relevance: .6, Instructions: 577COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A30E9A Relevance: .6, Instructions: 577COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A314A8 Relevance: .6, Instructions: 574COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31BE1 Relevance: .6, Instructions: 573COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A30E92 Relevance: .6, Instructions: 566COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A310F6 Relevance: .6, Instructions: 565COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31A4D Relevance: .6, Instructions: 556COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31800 Relevance: .6, Instructions: 555COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31AA9 Relevance: .5, Instructions: 541COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31E6F Relevance: .5, Instructions: 541COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31B0F Relevance: .5, Instructions: 539COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3178C Relevance: .5, Instructions: 535COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32C37 Relevance: .5, Instructions: 527COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32FDA Relevance: .5, Instructions: 527COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3162C Relevance: .5, Instructions: 522COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3189B Relevance: .5, Instructions: 518COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32441 Relevance: .5, Instructions: 518COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3198B Relevance: .5, Instructions: 517COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A315D0 Relevance: .5, Instructions: 514COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A326FB Relevance: .5, Instructions: 507COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31718 Relevance: .5, Instructions: 506COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A319F6 Relevance: .5, Instructions: 505COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3211C Relevance: .5, Instructions: 498COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A321E8 Relevance: .5, Instructions: 496COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3191C Relevance: .5, Instructions: 490COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31D0C Relevance: .5, Instructions: 489COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3233C Relevance: .5, Instructions: 487COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31B71 Relevance: .5, Instructions: 487COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32018 Relevance: .5, Instructions: 483COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3261D Relevance: .5, Instructions: 473COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31D82 Relevance: .4, Instructions: 450COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3218A Relevance: .4, Instructions: 447COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32897 Relevance: .4, Instructions: 442COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32E97 Relevance: .4, Instructions: 439COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A31F75 Relevance: .4, Instructions: 438COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32F3F Relevance: .4, Instructions: 435COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32D30 Relevance: .4, Instructions: 431COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A324DB Relevance: .4, Instructions: 429COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3296F Relevance: .4, Instructions: 417COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32DA2 Relevance: .4, Instructions: 411COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32260 Relevance: .4, Instructions: 409COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3269B Relevance: .4, Instructions: 399COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32552 Relevance: .4, Instructions: 390COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32B94 Relevance: .4, Instructions: 389COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32B01 Relevance: .4, Instructions: 386COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32909 Relevance: .4, Instructions: 380COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A3318B Relevance: .4, Instructions: 361COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32E1D Relevance: .4, Instructions: 360COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32A20 Relevance: .4, Instructions: 358COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04A32A08 Relevance: .3, Instructions: 330COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00404187 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 202windowstringCOMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 91% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405BEC Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00402C7C Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 40timeCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00404083 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 706B2498 Relevance: 10.6, APIs: 7, Instructions: 124COMMON
Download Yara Rule
| C-Code - Quality: 77% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040496F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 706B22B1 Relevance: 9.1, APIs: 6, Instructions: 140memoryCOMMON
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 37% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00404865 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
Download Yara Rule
| C-Code - Quality: 77% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405915 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00402CFF Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405018 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| C-Code - Quality: 89% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040595C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 706B10E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405A7B Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |