Loading ...

Play interactive tourEdit tour

Analysis Report 9fERLFJPjq.exe

Overview

General Information

Sample Name:9fERLFJPjq.exe
Analysis ID:1274527
MD5:ddd60e9ae362def377aa70d414ed374d
SHA1:ad33d0ff9adc122776771d51743ca855cd882b4d
SHA256:71b4a68d77929e2815ad7496882fce6c96c677fc154786621943fb90755477b3

Most interesting Screenshot:

Detection

DarkComet
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Yara detected DarkComet
Yara detected Generic Dropper
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Drops VBS files to the startup folder
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Potential malicious VBS script found (suspicious strings)
Tries to detect virtualization through RDTSC time measurements
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Enables debug privileges
Enables driver privileges
Enables security privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Tries to load missing DLLs
Yara detected Keylogger Generic
Yara signature match

Classification

Startup

  • System is w10x64_office
  • 9fERLFJPjq.exe (PID: 6088 cmdline: 'C:\Users\user\Desktop\9fERLFJPjq.exe' MD5: DDD60E9AE362DEF377AA70D414ED374D)
    • 9fERLFJPjq.exe (PID: 5844 cmdline: 'C:\Users\user\Desktop\9fERLFJPjq.exe' MD5: DDD60E9AE362DEF377AA70D414ED374D)
  • wscript.exe (PID: 368 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
    • enxavse.exe (PID: 880 cmdline: 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' MD5: D409D2D823F91A2DCC7EE6563B632BF3)
      • enxavse.exe (PID: 5520 cmdline: 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' MD5: D409D2D823F91A2DCC7EE6563B632BF3)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.602074619.00000000006C1000.00000004.00000001.sdmpDarkComet_2DarkCometJean-Philippe Teissier / @Jipe_
  • 0xf08:$a: #BEGIN DARKCOMET DATA --
  • 0xfd0:$a: #BEGIN DARKCOMET DATA --
  • 0xf80:$b: #EOF DARKCOMET DATA --
  • 0xee7:$c: DC_MUTEX-
00000006.00000002.602017158.0000000000696000.00000004.00000001.sdmpDarkComet_2DarkCometJean-Philippe Teissier / @Jipe_
  • 0x6e8:$k2: #KCMDDC51#-890
00000006.00000002.601989587.0000000000668000.00000004.00000001.sdmpDarkComet_2DarkCometJean-Philippe Teissier / @Jipe_
  • 0x138:$a: #BEGIN DARKCOMET DATA --
  • 0x2b8:$a: #BEGIN DARKCOMET DATA --
  • 0x1c7:$b: #EOF DARKCOMET DATA --
  • 0x347:$b: #EOF DARKCOMET DATA --
  • 0x159:$c: DC_MUTEX-
  • 0x2d9:$c: DC_MUTEX-
00000006.00000002.602066507.00000000006BA000.00000004.00000001.sdmpDarkComet_2DarkCometJean-Philippe Teissier / @Jipe_
  • 0x928:$c: DC_MUTEX-
  • 0x9e8:$k2: #KCMDDC51#-890
0000000B.00000002.503082454.0000000000668000.00000004.00000001.sdmpDarkComet_2DarkCometJean-Philippe Teissier / @Jipe_
  • 0x138:$a: #BEGIN DARKCOMET DATA --
  • 0x2b8:$a: #BEGIN DARKCOMET DATA --
  • 0x1c7:$b: #EOF DARKCOMET DATA --
  • 0x347:$b: #EOF DARKCOMET DATA --
  • 0x159:$c: DC_MUTEX-
  • 0x2d9:$c: DC_MUTEX-
Click to see the 36 entries

Sigma Overview

System Summary:

barindex
Sigma detected: Drops script at startup locationShow sources
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\9fERLFJPjq.exe, ProcessId: 6088, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Antivirus / Scanner detection for submitted sampleShow sources
Source: 9fERLFJPjq.exeAvira: detected
Source: 9fERLFJPjq.exeAvira: detected
Antivirus detection for dropped fileShow sources
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeAvira: detection malicious, Label: HEUR/AGEN.1112794
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeAvira: detection malicious, Label: HEUR/AGEN.1112794
Multi AV Scanner detection for domain / URLShow sources
Source: pownedfag.pwVirustotal: Detection: 8%Perma Link
Source: pownedfag.pwVirustotal: Detection: 8%Perma Link
Multi AV Scanner detection for dropped fileShow sources
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeVirustotal: Detection: 73%Perma Link
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeVirustotal: Detection: 73%Perma Link
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeReversingLabs: Detection: 65%
Multi AV Scanner detection for submitted fileShow sources
Source: 9fERLFJPjq.exeVirustotal: Detection: 74%Perma Link
Source: 9fERLFJPjq.exeMetadefender: Detection: 62%Perma Link
Source: 9fERLFJPjq.exeReversingLabs: Detection: 86%
Source: 9fERLFJPjq.exeVirustotal: Detection: 74%Perma Link
Source: 9fERLFJPjq.exeMetadefender: Detection: 62%Perma Link
Source: 9fERLFJPjq.exeReversingLabs: Detection: 86%
Machine Learning detection for dropped fileShow sources
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeJoe Sandbox ML: detected
Machine Learning detection for sampleShow sources
Source: 9fERLFJPjq.exeJoe Sandbox ML: detected
Source: 9fERLFJPjq.exeJoe Sandbox ML: detected
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: unknownDNS traffic detected: queries for: pownedfag.pw
Source: unknownDNS traffic detected: queries for: pownedfag.pw

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hookShow sources
Source: C:\Users\user\Desktop\9fERLFJPjq.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\9fERLFJPjq.exeJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\9fERLFJPjq.exeJump to behavior
Source: enxavse.exe, 00000008.00000002.500606567.000000000093A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Source: enxavse.exe, 00000008.00000002.500606567.000000000093A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Source: Yara matchFile source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORY
Source: Yara matchFile source: Process Memory Space: enxavse.exe PID: 880, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)Show sources
Source: 00000006.00000002.602074619.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000006.00000002.602017158.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000006.00000002.601989587.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000006.00000002.602066507.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 0000000B.00000002.503082454.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 0000000B.00000002.503148674.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: 0000000B.00000002.503141508.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 0000000B.00000002.503100449.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: Process Memory Space: 9fERLFJPjq.exe PID: 5844, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: Process Memory Space: enxavse.exe PID: 5520, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000006.00000002.602074619.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000006.00000002.602017158.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000006.00000002.601989587.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000006.00000002.602066507.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 0000000B.00000002.503082454.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 0000000B.00000002.503148674.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: 0000000B.00000002.503141508.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: 0000000B.00000002.503100449.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: Process Memory Space: 9fERLFJPjq.exe PID: 5844, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: Detects DarkComet RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet RAT Author: botherder https://github.com/botherder
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_3 Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_4 Author: unknown
Source: Process Memory Space: enxavse.exe PID: 5520, type: MEMORYMatched rule: DarkComet Author: Jean-Philippe Teissier / @Jipe_
Yara detected DarkCometShow sources
Source: Yara matchFile source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORY
Source: Yara matchFile source: Process Memory Space: enxavse.exe PID: 880, type: MEMORY
Potential malicious VBS script found (suspicious strings)Show sources
Source: C:\Users\user\Desktop\9fERLFJPjq.exeDropped file: objShell.ShellExecute "C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe", "", "", "", 1Jump to dropped file
Source: C:\Users\user\Desktop\9fERLFJPjq.exeDropped file: objShell.ShellExecute "C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe", "", "", "", 1Jump to dropped file
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess token adjusted: Load DriverJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess token adjusted: Load DriverJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess token adjusted: SecurityJump to behavior
Source: 9fERLFJPjq.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9fERLFJPjq.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: enxavse.exe.2.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: enxavse.exe.2.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9fERLFJPjq.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9fERLFJPjq.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: enxavse.exe.2.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: enxavse.exe.2.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9fERLFJPjq.exe, 00000002.00000002.601937327.0000000000547000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAmamau.exe<?xml version="1.0" encoding="UTF-8" standalone="yes"?> vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameMSRSAAP.EXEV vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000002.00000002.602900469.00000000021D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000006.00000000.387200650.0000000000547000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAmamau.exe<?xml version="1.0" encoding="UTF-8" standalone="yes"?> vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000006.00000002.601302452.00000000001E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameAVICAP32.DLL.MUIj% vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000006.00000002.603021982.0000000002450000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exeBinary or memory string: OriginalFilenameAmamau.exe<?xml version="1.0" encoding="UTF-8" standalone="yes"?> vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000002.00000002.601937327.0000000000547000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAmamau.exe<?xml version="1.0" encoding="UTF-8" standalone="yes"?> vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameMSRSAAP.EXEV vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000002.00000002.602900469.00000000021D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000006.00000000.387200650.0000000000547000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAmamau.exe<?xml version="1.0" encoding="UTF-8" standalone="yes"?> vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000006.00000002.601302452.00000000001E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameAVICAP32.DLL.MUIj% vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exe, 00000006.00000002.603021982.0000000002450000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs 9fERLFJPjq.exe
Source: 9fERLFJPjq.exeBinary or memory string: OriginalFilenameAmamau.exe<?xml version="1.0" encoding="UTF-8" standalone="yes"?> vs 9fERLFJPjq.exe
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: 00000006.00000002.602074619.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000006.00000002.602017158.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000006.00000002.601989587.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000006.00000002.602066507.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 0000000B.00000002.503082454.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 0000000B.00000002.503148674.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: Malware_QA_update_RID2DAD date = 2016-08-29 10:42:01, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/, score = demo, minimum_yara = 1.7
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18_RID328F date = 2018-02-14 14:10:21, author = Florian Roth, description = Semiautomatic generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/, score = demo, minimum_yara = 1.7
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: 0000000B.00000002.503141508.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 0000000B.00000002.503100449.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: Process Memory Space: 9fERLFJPjq.exe PID: 5844, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: Process Memory Space: enxavse.exe PID: 5520, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000006.00000002.602074619.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000006.00000002.602017158.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000006.00000002.601989587.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000006.00000002.602066507.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 0000000B.00000002.503082454.0000000000668000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 0000000B.00000002.503148674.00000000006C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: Malware_QA_update_RID2DAD date = 2016-08-29 10:42:01, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/, score = demo, minimum_yara = 1.7
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18_RID328F date = 2018-02-14 14:10:21, author = Florian Roth, description = Semiautomatic generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/, score = demo, minimum_yara = 1.7
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: 0000000B.00000002.503141508.00000000006BA000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: 0000000B.00000002.503100449.0000000000696000.00000004.00000001.sdmp, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: Process Memory Space: 9fERLFJPjq.exe PID: 5844, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: RAT_DarkComet date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_1 author = botherder https://github.com/botherder, description = DarkComet RAT
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_3 date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/DarkComet
Source: Process Memory Space: enxavse.exe PID: 880, type: MEMORYMatched rule: DarkComet_4 reference = https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
Source: Process Memory Space: enxavse.exe PID: 5520, type: MEMORYMatched rule: DarkComet_2 date = 2013-01-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = DarkComet, version = 1.0
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@8/2@349/0
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeMutant created: \Sessions\1\BaseNamedObjects\DC_MUTEX-HXSPSH8
Source: C:\Users\user\Desktop\9fERLFJPjq.exeMutant created: \Sessions\1\BaseNamedObjects\DC_MUTEX-HXSPSH8
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Local\Temp\ExjoaresJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Local\Temp\ExjoaresJump to behavior
Source: Yara matchFile source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, type: MEMORY
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs'
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs'
Source: 9fERLFJPjq.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 9fERLFJPjq.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\9fERLFJPjq.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: 9fERLFJPjq.exeVirustotal: Detection: 74%
Source: 9fERLFJPjq.exeMetadefender: Detection: 62%
Source: 9fERLFJPjq.exeReversingLabs: Detection: 86%
Source: 9fERLFJPjq.exeVirustotal: Detection: 74%
Source: 9fERLFJPjq.exeMetadefender: Detection: 62%
Source: 9fERLFJPjq.exeReversingLabs: Detection: 86%
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Users\user\Desktop\9fERLFJPjq.exeJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile read: C:\Users\user\Desktop\9fERLFJPjq.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe'
Source: unknownProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe'
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs'
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe'
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe'
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe' Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe'
Source: unknownProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe'
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs'
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe'
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe'
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe' Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: 9fERLFJPjq.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: 9fERLFJPjq.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: 9fERLFJPjq.exeStatic file information: File size 1593344 > 1048576
Source: 9fERLFJPjq.exeStatic file information: File size 1593344 > 1048576
Source: 9fERLFJPjq.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x13f000
Source: 9fERLFJPjq.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x13f000
Source: enxavse.exe.2.drStatic PE information: real checksum: 0x191aaa should be: 0x191ac2
Source: 9fERLFJPjq.exeStatic PE information: real checksum: 0x191aaa should be: 0x191ab6
Source: enxavse.exe.2.drStatic PE information: real checksum: 0x191aaa should be: 0x191ac2
Source: 9fERLFJPjq.exeStatic PE information: real checksum: 0x191aaa should be: 0x191ab6
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeJump to dropped file
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeJump to dropped file

Boot Survival:

barindex
Drops VBS files to the startup folderShow sources
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to dropped file
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to dropped file
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbsJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion:

barindex
Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
Source: C:\Users\user\Desktop\9fERLFJPjq.exeRDTSC instruction interceptor: First address: 000000000052B688 second address: 000000000052B6BD instructions: 0x00000000 rdtsc 0x00000002 test dh, 00000036h 0x00000005 paddd mm1, mm2 0x00000008 cmp bx, B97Fh 0x0000000d mov eax, esp 0x0000000f cmp cx, C32Fh 0x00000014 mov eax, dword ptr [eax+28h] 0x00000017 test ch, 00000071h 0x0000001a movd mm4, eax 0x0000001d test ch, 00000043h 0x00000020 pxor mm4, mm1 0x00000023 cmp ax, 0000DCD4h 0x00000027 movd ebx, mm4 0x0000002a test ch, 00000029h 0x0000002d cmp ebx, 636F6C6Ch 0x00000033 jne 00007F7368CE7B4Ah
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeRDTSC instruction interceptor: First address: 000000000052B688 second address: 000000000052B6BD instructions: 0x00000000 rdtsc 0x00000002 test dh, 00000036h 0x00000005 paddd mm1, mm2 0x00000008 cmp bx, B97Fh 0x0000000d mov eax, esp 0x0000000f cmp cx, C32Fh 0x00000014 mov eax, dword ptr [eax+28h] 0x00000017 test ch, 00000071h 0x0000001a movd mm4, eax 0x0000001d test ch, 00000043h 0x00000020 pxor mm4, mm1 0x00000023 cmp ax, 0000DCD4h 0x00000027 movd ebx, mm4 0x0000002a test ch, 00000029h 0x0000002d cmp ebx, 636F6C6Ch 0x00000033 jne 00007F73688EB32Ah
Tries to detect virtualization through RDTSC time measurementsShow sources
Source: C:\Users\user\Desktop\9fERLFJPjq.exeRDTSC instruction interceptor: First address: 000000000052B688 second address: 000000000052B6BD instructions: 0x00000000 rdtsc 0x00000002 test dh, 00000036h 0x00000005 paddd mm1, mm2 0x00000008 cmp bx, B97Fh 0x0000000d mov eax, esp 0x0000000f cmp cx, C32Fh 0x00000014 mov eax, dword ptr [eax+28h] 0x00000017 test ch, 00000071h 0x0000001a movd mm4, eax 0x0000001d test ch, 00000043h 0x00000020 pxor mm4, mm1 0x00000023 cmp ax, 0000DCD4h 0x00000027 movd ebx, mm4 0x0000002a test ch, 00000029h 0x0000002d cmp ebx, 636F6C6Ch 0x00000033 jne 00007F7368CE7B4Ah
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeRDTSC instruction interceptor: First address: 000000000052B688 second address: 000000000052B6BD instructions: 0x00000000 rdtsc 0x00000002 test dh, 00000036h 0x00000005 paddd mm1, mm2 0x00000008 cmp bx, B97Fh 0x0000000d mov eax, esp 0x0000000f cmp cx, C32Fh 0x00000014 mov eax, dword ptr [eax+28h] 0x00000017 test ch, 00000071h 0x0000001a movd mm4, eax 0x0000001d test ch, 00000043h 0x00000020 pxor mm4, mm1 0x00000023 cmp ax, 0000DCD4h 0x00000027 movd ebx, mm4 0x0000002a test ch, 00000029h 0x0000002d cmp ebx, 636F6C6Ch 0x00000033 jne 00007F73688EB32Ah
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exe TID: 1820Thread sleep time: -63800s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe TID: 6076Thread sleep count: 67 > 30Jump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exe TID: 1820Thread sleep time: -63800s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe TID: 6076Thread sleep count: 67 > 30Jump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\9fERLFJPjq.exeLast function: Thread delayed
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jump to behavior
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe' Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeProcess created: C:\Users\user\Desktop\9fERLFJPjq.exe 'C:\Users\user\Desktop\9fERLFJPjq.exe' Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeProcess created: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe 'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe' Jump to behavior
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh<
Source: 9fERLFJPjq.exe, 00000002.00000002.602698012.0000000000DC0000.00000002.00000001.sdmp, 9fERLFJPjq.exe, 00000006.00000002.602880501.0000000001010000.00000002.00000001.sdmpBinary or memory string: Program ManagerWv{
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, 9fERLFJPjq.exe, 00000006.00000002.602880501.0000000001010000.00000002.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, 9fERLFJPjq.exe, 00000006.00000002.602880501.0000000001010000.00000002.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Progman
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_TrayWndjjh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Progmanjhh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndTrayNotifyWndjh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: ProgmanU
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: ButtonShell_TrayWndj
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndReBarWindow32jh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndReBarWindow32jhD
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywnd
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_TrayWndPjjh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh<
Source: 9fERLFJPjq.exe, 00000002.00000002.602698012.0000000000DC0000.00000002.00000001.sdmp, 9fERLFJPjq.exe, 00000006.00000002.602880501.0000000001010000.00000002.00000001.sdmpBinary or memory string: Program ManagerWv{
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, 9fERLFJPjq.exe, 00000006.00000002.602880501.0000000001010000.00000002.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, 9fERLFJPjq.exe, 00000006.00000002.602880501.0000000001010000.00000002.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Progman
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_TrayWndjjh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Progmanjhh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndTrayNotifyWndjh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: ProgmanU
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: ButtonShell_TrayWndj
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndReBarWindow32jh
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywndReBarWindow32jhD
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_traywnd
Source: 9fERLFJPjq.exe, 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, enxavse.exe, 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmpBinary or memory string: Shell_TrayWndPjjh
Source: C:\Users\user\Desktop\9fERLFJPjq.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\9fERLFJPjq.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Generic DropperShow sources
Source: Yara matchFile source: Process Memory Space: 9fERLFJPjq.exe PID: 6088, type: MEMORY

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting211Startup Items1Startup Items1Masquerading1Input Capture111Security Software Discovery3Remote ServicesInput Capture111Exfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobRegistry Run Keys / Startup Folder2Process Injection12Virtualization/Sandbox Evasion1LSASS MemoryVirtualization/Sandbox Evasion1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)LSASS Driver1Registry Run Keys / Startup Folder2Process Injection12Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)DLL Side-Loading1LSASS Driver1Scripting211NTDSRemote System Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptDLL Side-Loading1DLL Side-Loading1LSA SecretsFile and Directory Discovery2SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsSystem Information Discovery212VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
9fERLFJPjq.exe75%VirustotalBrowse
9fERLFJPjq.exe65%MetadefenderBrowse
9fERLFJPjq.exe86%ReversingLabsWin32.Infostealer.PonyStealer
9fERLFJPjq.exe100%AviraHEUR/AGEN.1112794
9fERLFJPjq.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe100%AviraHEUR/AGEN.1112794
C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe73%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe66%ReversingLabsWin32.Trojan.Symmi

Unpacked PE Files

No Antivirus matches

Domains

SourceDetectionScannerLabelLink
pownedfag.pw9%VirustotalBrowse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
pownedfag.pw
unknown
unknowntrueunknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:30.0.0 Red Diamond
Analysis ID:1274527
Start date:31.10.2020
Start time:22:55:53
Joe Sandbox Product:Cloud
Overall analysis duration:0h 5m 13s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:9fERLFJPjq.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit (version 1803) with Office 2016 Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:13
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal100.troj.spyw.evad.winEXE@8/2@349/0
Cookbook Comments:
  • Adjust boot time
  • Found application associated with file extension: .exe
Warnings:
Show All
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 2.20.142.209, 2.20.142.210
  • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, audownload.windowsupdate.nsatc.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, au-bg-shim.trafficmanager.net
  • Report size getting too big, too many NtDeviceIoControlFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.

Signature Similarity

Sample Distance (10 = nearest)
10 9 8 7 6 5 4 3 2 1
Samplename Analysis ID SHA256 Similarity

Simulations

Behavior and APIs

TimeTypeDescription
22:58:03AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe
Process:C:\Users\user\Desktop\9fERLFJPjq.exe
File Type:PE32 executable (GUI) Intel 80386, for MS Windows
Category:dropped
Size (bytes):1593344
Entropy (8bit):6.1273220474956585
Encrypted:false
SSDEEP:24576:5VFstxjDwKaxoaacAx5elx7IwQPDR/20B9/En9+:jKtx/naxoaafx5sx7ZQPF/2g
MD5:D409D2D823F91A2DCC7EE6563B632BF3
SHA1:CF458BA081326F5ABEF51FC49C029691E31DE798
SHA-256:93FC7E03EF797A702427D45C49B15D9CEC8902023E1964D7EF245B49F15A7467
SHA-512:980DC1083D217BB9F23F5E8ED06453032B7B49C67C78FF005F3DC26558DA23F4A840AE14929F75CA00340E42731FB390ABC48877AE534B3548B5B3E9F63BA4E8
Malicious:true
Antivirus:
  • Antivirus: Avira, Detection: 100%
  • Antivirus: Joe Sandbox ML, Detection: 100%
  • Antivirus: Virustotal, Detection: 73%, Browse
  • Antivirus: ReversingLabs, Detection: 66%
Reputation:low
Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................................Rich...........PE..L.....jX..........................................@.........................................................................T...(....p..89..................................................................(... ....................................text............................... ..`.data...\e..........................@....rsrc...89...p...@..................@..@...I............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs
Process:C:\Users\user\Desktop\9fERLFJPjq.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):384
Entropy (8bit):2.735492028162851
Encrypted:false
SSDEEP:3:j+qAHmFEm86oQ/FERMQsNC2xAvOyyiE2J5xAI81SiHFHrLL:j+q9Nht6Gzyy23fri
MD5:4D51A387E345D7647D448829FA4721E1
SHA1:B6436CC59AC5316B7C6566E799226E450C0DBA8A
SHA-256:BF14C4B45AA14144D0B7FC6642CECCB7977E1588076CDE04B19A3B4D2D9CAC5D
SHA-512:23FBBC57DC9A3FD8C8CE296E1BEB1582B1DFFEEADB54AE74C01897CD5779866C8C8726B0CCACAE47BFF69DDF3C6A7804E441D43217202FC18075A35AB5BCB8C0
Malicious:true
Reputation:low
Preview: Set objShell = CreateObject("Shell.Application")..objShell.ShellExecute "C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe", "", "", "", 1..................................................................................................................................................................................................................................................

Static File Info

General

File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):6.127320166154349
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.15%
  • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:9fERLFJPjq.exe
File size:1593344
MD5:ddd60e9ae362def377aa70d414ed374d
SHA1:ad33d0ff9adc122776771d51743ca855cd882b4d
SHA256:71b4a68d77929e2815ad7496882fce6c96c677fc154786621943fb90755477b3
SHA512:ae05c72a51694d6048874cf73d59ab763bb44249b92304c9e15f87ad78cd4801b424b7961543086e3b08aa116022ad3b3634850566ef3979ca003eb6ed650369
SSDEEP:24576:iVFstxjDwKaxoaacAx5elx7IwQPcR/20B9/En9+:QKtx/naxoaafx5sx7ZQPC/2g
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................Rich............PE..L.....jX..........................................@................

File Icon

Icon Hash:f0b0b2b2e8aaa6c2

Static PE Info

General

Entrypoint:0x4019f0
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:0x586AC81E [Mon Jan 2 21:37:34 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:30206b822448e92e4bc425d017e3f08f

Entrypoint Preview

Instruction
push 0052FC24h
call 00007F7368EB5B75h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ah, al
out 86h, eax

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x13ef540x28.text
IMAGE_DIRECTORY_ENTRY_RESOURCE0x1470000x43938.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
IMAGE_DIRECTORY_ENTRY_IAT0x10000x104.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x13e3d40x13f000False0.583817532817data5.85654728614IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data0x1400000x655c0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc0x1470000x439380x44000False0.62591193704data7.02544070644IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountry
RT_ICON0x1473840x1b284PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON0x1626080x10828dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 302384646, next used block 100663296
RT_ICON0x172e300x94a8data
RT_ICON0x17c2d80x5488data
RT_ICON0x1817600x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 224, next used block 117440512
RT_ICON0x1859880x25a8data
RT_ICON0x187f300x10a8data
RT_ICON0x188fd80x988data
RT_ICON0x1899600x468GLS_BINARY_LSB_FIRST
RT_ICON0x189dc80x130data
RT_ICON0x189ef80x2e8data
RT_ICON0x18a1e00x128GLS_BINARY_LSB_FIRST
RT_GROUP_ICON0x18a3080x84data
RT_GROUP_ICON0x18a38c0x30data
RT_VERSION0x18a3bc0x284dataEnglishUnited States
RT_MANIFEST0x18a6400x2f7XML 1.0 document, ASCII text, with CRLF line terminatorsCatalanSpain

Imports

DLLImport
MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaI2I4, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaVarMul, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaVarCat, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarSetVar, __vbaI4Var, __vbaVarAdd, __vbaVarDup, __vbaFpI4, __vbaVarLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

DescriptionData
Translation0x0403 0x04b0
InternalNameAmamau
FileVersion1.03.0009
CompanyNameAsrock
CommentsJaacata
ProductNameNdoe5
ProductVersion1.03.0009
FileDescriptionJaacata
OriginalFilenameAmamau.exe

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States
CatalanSpain

Network Behavior

Network Port Distribution

UDP Packets

TimestampSource PortDest PortSource IPDest IP
Oct 31, 2020 22:57:58.356106997 CET5620753192.168.1.1028.8.8.8
Oct 31, 2020 22:57:58.394027948 CET53562078.8.8.8192.168.1.102
Oct 31, 2020 22:57:58.659580946 CET5347753192.168.1.1028.8.8.8
Oct 31, 2020 22:57:58.692158937 CET53534778.8.8.8192.168.1.102
Oct 31, 2020 22:57:58.942051888 CET5976553192.168.1.1028.8.8.8
Oct 31, 2020 22:57:58.974617004 CET53597658.8.8.8192.168.1.102
Oct 31, 2020 22:57:59.236418009 CET5649153192.168.1.1028.8.8.8
Oct 31, 2020 22:57:59.276905060 CET53564918.8.8.8192.168.1.102
Oct 31, 2020 22:57:59.496068954 CET5483453192.168.1.1028.8.8.8
Oct 31, 2020 22:57:59.530893087 CET53548348.8.8.8192.168.1.102
Oct 31, 2020 22:57:59.761670113 CET5555153192.168.1.1028.8.8.8
Oct 31, 2020 22:57:59.794290066 CET53555518.8.8.8192.168.1.102
Oct 31, 2020 22:58:00.019314051 CET5825853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:00.059798002 CET53582588.8.8.8192.168.1.102
Oct 31, 2020 22:58:00.294744015 CET5004253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:00.327389956 CET53500428.8.8.8192.168.1.102
Oct 31, 2020 22:58:00.542402983 CET5637453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:00.575041056 CET53563748.8.8.8192.168.1.102
Oct 31, 2020 22:58:00.791368961 CET6022053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:00.815601110 CET53602208.8.8.8192.168.1.102
Oct 31, 2020 22:58:01.040200949 CET5714853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:01.072635889 CET53571488.8.8.8192.168.1.102
Oct 31, 2020 22:58:01.315272093 CET5703853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:01.347723961 CET53570388.8.8.8192.168.1.102
Oct 31, 2020 22:58:01.564667940 CET6415953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:01.596940041 CET53641598.8.8.8192.168.1.102
Oct 31, 2020 22:58:01.817579031 CET6543953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:01.850222111 CET53654398.8.8.8192.168.1.102
Oct 31, 2020 22:58:01.881184101 CET5198753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:01.915091038 CET53519878.8.8.8192.168.1.102
Oct 31, 2020 22:58:02.068314075 CET5892053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:02.092422962 CET53589208.8.8.8192.168.1.102
Oct 31, 2020 22:58:02.332345009 CET6104753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:02.365031004 CET53610478.8.8.8192.168.1.102
Oct 31, 2020 22:58:02.601298094 CET6382453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:02.633838892 CET53638248.8.8.8192.168.1.102
Oct 31, 2020 22:58:02.866518021 CET6539653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:02.899205923 CET53653968.8.8.8192.168.1.102
Oct 31, 2020 22:58:03.309684038 CET5663253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:03.333837986 CET53566328.8.8.8192.168.1.102
Oct 31, 2020 22:58:03.552083015 CET5903453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:03.584611893 CET53590348.8.8.8192.168.1.102
Oct 31, 2020 22:58:03.811285973 CET6160453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:03.844147921 CET53616048.8.8.8192.168.1.102
Oct 31, 2020 22:58:04.077286959 CET5464953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:04.109910965 CET53546498.8.8.8192.168.1.102
Oct 31, 2020 22:58:04.325582981 CET5659453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:04.357940912 CET53565948.8.8.8192.168.1.102
Oct 31, 2020 22:58:04.576935053 CET6467453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:04.609405041 CET53646748.8.8.8192.168.1.102
Oct 31, 2020 22:58:04.842366934 CET6457553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:04.875086069 CET53645758.8.8.8192.168.1.102
Oct 31, 2020 22:58:05.088447094 CET6274653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:05.121138096 CET53627468.8.8.8192.168.1.102
Oct 31, 2020 22:58:05.331859112 CET5701753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:05.355911970 CET53570178.8.8.8192.168.1.102
Oct 31, 2020 22:58:05.575695038 CET5137053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:05.599952936 CET53513708.8.8.8192.168.1.102
Oct 31, 2020 22:58:05.828222990 CET6425253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:05.860693932 CET53642528.8.8.8192.168.1.102
Oct 31, 2020 22:58:06.113827944 CET5692853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:06.146298885 CET53569288.8.8.8192.168.1.102
Oct 31, 2020 22:58:06.370800972 CET6544153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:06.403548002 CET53654418.8.8.8192.168.1.102
Oct 31, 2020 22:58:06.629591942 CET5072053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:06.653817892 CET53507208.8.8.8192.168.1.102
Oct 31, 2020 22:58:06.895286083 CET6540153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:06.927692890 CET53654018.8.8.8192.168.1.102
Oct 31, 2020 22:58:07.142600060 CET5086153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:07.166835070 CET53508618.8.8.8192.168.1.102
Oct 31, 2020 22:58:07.391448975 CET5175553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:07.426150084 CET53517558.8.8.8192.168.1.102
Oct 31, 2020 22:58:07.643035889 CET5046353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:07.667279959 CET53504638.8.8.8192.168.1.102
Oct 31, 2020 22:58:07.887782097 CET5676953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:07.920172930 CET53567698.8.8.8192.168.1.102
Oct 31, 2020 22:58:08.174350977 CET5191653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:08.198610067 CET53519168.8.8.8192.168.1.102
Oct 31, 2020 22:58:08.437330961 CET5694253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:08.461559057 CET53569428.8.8.8192.168.1.102
Oct 31, 2020 22:58:08.670663118 CET5506853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:08.703073025 CET53550688.8.8.8192.168.1.102
Oct 31, 2020 22:58:08.916201115 CET5384153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:08.948748112 CET53538418.8.8.8192.168.1.102
Oct 31, 2020 22:58:09.166476011 CET6482853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:09.199018955 CET53648288.8.8.8192.168.1.102
Oct 31, 2020 22:58:09.410628080 CET5635853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:09.434798002 CET53563588.8.8.8192.168.1.102
Oct 31, 2020 22:58:09.655642986 CET6356153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:09.679802895 CET53635618.8.8.8192.168.1.102
Oct 31, 2020 22:58:09.901715994 CET5139453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:09.934288979 CET53513948.8.8.8192.168.1.102
Oct 31, 2020 22:58:10.241559029 CET4999253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:10.265716076 CET53499928.8.8.8192.168.1.102
Oct 31, 2020 22:58:11.119221926 CET4980953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:11.143455982 CET53498098.8.8.8192.168.1.102
Oct 31, 2020 22:58:11.486649036 CET5653453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:11.519293070 CET53565348.8.8.8192.168.1.102
Oct 31, 2020 22:58:12.063915014 CET6034753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:12.088180065 CET53603478.8.8.8192.168.1.102
Oct 31, 2020 22:58:12.360224962 CET5719653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:12.392833948 CET53571968.8.8.8192.168.1.102
Oct 31, 2020 22:58:12.638248920 CET4985453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:12.670840025 CET53498548.8.8.8192.168.1.102
Oct 31, 2020 22:58:12.888031006 CET5563653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:12.912288904 CET53556368.8.8.8192.168.1.102
Oct 31, 2020 22:58:13.152443886 CET5263953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:13.176635981 CET53526398.8.8.8192.168.1.102
Oct 31, 2020 22:58:13.389481068 CET5108153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:13.421798944 CET53510818.8.8.8192.168.1.102
Oct 31, 2020 22:58:13.637166977 CET5409153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:13.661380053 CET53540918.8.8.8192.168.1.102
Oct 31, 2020 22:58:13.882484913 CET5069853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:13.915235996 CET53506988.8.8.8192.168.1.102
Oct 31, 2020 22:58:14.129964113 CET5923653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:14.162384987 CET53592368.8.8.8192.168.1.102
Oct 31, 2020 22:58:14.379251003 CET5642453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:14.411956072 CET53564248.8.8.8192.168.1.102
Oct 31, 2020 22:58:14.622591972 CET4928153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:14.657351971 CET53492818.8.8.8192.168.1.102
Oct 31, 2020 22:58:14.865195990 CET6312053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:14.897814035 CET53631208.8.8.8192.168.1.102
Oct 31, 2020 22:58:15.108350039 CET5270053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:15.132586956 CET53527008.8.8.8192.168.1.102
Oct 31, 2020 22:58:15.339456081 CET6143953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:15.371829033 CET53614398.8.8.8192.168.1.102
Oct 31, 2020 22:58:15.587194920 CET5361853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:15.619775057 CET53536188.8.8.8192.168.1.102
Oct 31, 2020 22:58:15.833266973 CET5926853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:15.857454062 CET53592688.8.8.8192.168.1.102
Oct 31, 2020 22:58:16.083573103 CET5165653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:16.107834101 CET53516568.8.8.8192.168.1.102
Oct 31, 2020 22:58:16.334146023 CET6419353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:16.358230114 CET53641938.8.8.8192.168.1.102
Oct 31, 2020 22:58:16.581343889 CET5778253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:16.605617046 CET53577828.8.8.8192.168.1.102
Oct 31, 2020 22:58:16.854422092 CET5933553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:16.878748894 CET53593358.8.8.8192.168.1.102
Oct 31, 2020 22:58:17.094836950 CET6035553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:17.127824068 CET53603558.8.8.8192.168.1.102
Oct 31, 2020 22:58:17.352400064 CET5723053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:17.385077953 CET53572308.8.8.8192.168.1.102
Oct 31, 2020 22:58:17.597307920 CET5398953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:17.621516943 CET53539898.8.8.8192.168.1.102
Oct 31, 2020 22:58:17.848023891 CET6385753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:17.880671978 CET53638578.8.8.8192.168.1.102
Oct 31, 2020 22:58:18.092550039 CET5572053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:18.116739035 CET53557208.8.8.8192.168.1.102
Oct 31, 2020 22:58:18.337786913 CET6124053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:18.361890078 CET53612408.8.8.8192.168.1.102
Oct 31, 2020 22:58:18.574656010 CET5159553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:18.607055902 CET53515958.8.8.8192.168.1.102
Oct 31, 2020 22:58:18.816879034 CET5750553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:18.841288090 CET53575058.8.8.8192.168.1.102
Oct 31, 2020 22:58:19.060357094 CET5298553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:19.093238115 CET53529858.8.8.8192.168.1.102
Oct 31, 2020 22:58:19.300507069 CET5237153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:19.324656010 CET53523718.8.8.8192.168.1.102
Oct 31, 2020 22:58:19.550453901 CET4934353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:19.574682951 CET53493438.8.8.8192.168.1.102
Oct 31, 2020 22:58:19.791575909 CET5458753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:19.815844059 CET53545878.8.8.8192.168.1.102
Oct 31, 2020 22:58:20.035082102 CET5895253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:20.067749977 CET53589528.8.8.8192.168.1.102
Oct 31, 2020 22:58:20.282563925 CET6497253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:20.317482948 CET53649728.8.8.8192.168.1.102
Oct 31, 2020 22:58:20.531861067 CET5461453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:20.556108952 CET53546148.8.8.8192.168.1.102
Oct 31, 2020 22:58:20.780188084 CET6068353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:20.812860966 CET53606838.8.8.8192.168.1.102
Oct 31, 2020 22:58:21.034014940 CET4968553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:21.058366060 CET53496858.8.8.8192.168.1.102
Oct 31, 2020 22:58:21.288301945 CET5752353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:21.312442064 CET53575238.8.8.8192.168.1.102
Oct 31, 2020 22:58:21.531739950 CET4986253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:21.564377069 CET53498628.8.8.8192.168.1.102
Oct 31, 2020 22:58:21.775712013 CET5075953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:21.799909115 CET53507598.8.8.8192.168.1.102
Oct 31, 2020 22:58:22.013997078 CET5428353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:22.038214922 CET53542838.8.8.8192.168.1.102
Oct 31, 2020 22:58:22.249692917 CET5435053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:22.282382011 CET53543508.8.8.8192.168.1.102
Oct 31, 2020 22:58:22.496064901 CET5529753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:22.528485060 CET53552978.8.8.8192.168.1.102
Oct 31, 2020 22:58:22.754255056 CET6240553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:22.778407097 CET53624058.8.8.8192.168.1.102
Oct 31, 2020 22:58:22.987730980 CET5004453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:23.011904001 CET53500448.8.8.8192.168.1.102
Oct 31, 2020 22:58:23.237608910 CET5909553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:23.261676073 CET53590958.8.8.8192.168.1.102
Oct 31, 2020 22:58:23.484697104 CET6546753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:23.508753061 CET53654678.8.8.8192.168.1.102
Oct 31, 2020 22:58:23.720062017 CET5958653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:23.744277954 CET53595868.8.8.8192.168.1.102
Oct 31, 2020 22:58:23.952507019 CET5778353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:23.985146046 CET53577838.8.8.8192.168.1.102
Oct 31, 2020 22:58:24.201069117 CET5414653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:24.225156069 CET53541468.8.8.8192.168.1.102
Oct 31, 2020 22:58:24.452256918 CET5380353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:24.476434946 CET53538038.8.8.8192.168.1.102
Oct 31, 2020 22:58:24.705614090 CET6235153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:24.738022089 CET53623518.8.8.8192.168.1.102
Oct 31, 2020 22:58:25.002012968 CET5730753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:25.026257992 CET53573078.8.8.8192.168.1.102
Oct 31, 2020 22:58:25.269138098 CET5645553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:25.293188095 CET53564558.8.8.8192.168.1.102
Oct 31, 2020 22:58:25.519251108 CET5460553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:25.543380022 CET53546058.8.8.8192.168.1.102
Oct 31, 2020 22:58:25.770019054 CET5899353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:25.794158936 CET53589938.8.8.8192.168.1.102
Oct 31, 2020 22:58:26.021261930 CET5251453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:26.045578003 CET53525148.8.8.8192.168.1.102
Oct 31, 2020 22:58:26.331233978 CET6218653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:26.355210066 CET53621868.8.8.8192.168.1.102
Oct 31, 2020 22:58:26.566318989 CET6194753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:26.590398073 CET53619478.8.8.8192.168.1.102
Oct 31, 2020 22:58:26.813718081 CET6307953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:26.837829113 CET53630798.8.8.8192.168.1.102
Oct 31, 2020 22:58:27.056814909 CET4965653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:27.081043005 CET53496568.8.8.8192.168.1.102
Oct 31, 2020 22:58:27.312645912 CET5218053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:27.336785078 CET53521808.8.8.8192.168.1.102
Oct 31, 2020 22:58:27.611253977 CET5981453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:27.635328054 CET53598148.8.8.8192.168.1.102
Oct 31, 2020 22:58:27.957024097 CET5494653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:27.989484072 CET53549468.8.8.8192.168.1.102
Oct 31, 2020 22:58:28.633605003 CET5511853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:28.666385889 CET53551188.8.8.8192.168.1.102
Oct 31, 2020 22:58:28.967077017 CET5710753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:28.991214991 CET53571078.8.8.8192.168.1.102
Oct 31, 2020 22:58:29.646918058 CET5671253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:29.679399967 CET53567128.8.8.8192.168.1.102
Oct 31, 2020 22:58:29.896704912 CET6291353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:29.920857906 CET53629138.8.8.8192.168.1.102
Oct 31, 2020 22:58:30.132014036 CET6132153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:30.156132936 CET53613218.8.8.8192.168.1.102
Oct 31, 2020 22:58:30.377209902 CET6411753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:30.409487963 CET53641178.8.8.8192.168.1.102
Oct 31, 2020 22:58:30.629019022 CET5683053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:30.653052092 CET53568308.8.8.8192.168.1.102
Oct 31, 2020 22:58:30.870219946 CET5568553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:30.894418001 CET53556858.8.8.8192.168.1.102
Oct 31, 2020 22:58:31.118225098 CET5919353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:31.142339945 CET53591938.8.8.8192.168.1.102
Oct 31, 2020 22:58:31.351303101 CET4994453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:31.375416994 CET53499448.8.8.8192.168.1.102
Oct 31, 2020 22:58:31.599716902 CET4916453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:31.623965979 CET53491648.8.8.8192.168.1.102
Oct 31, 2020 22:58:31.847336054 CET5916053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:31.871427059 CET53591608.8.8.8192.168.1.102
Oct 31, 2020 22:58:32.092302084 CET6093753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:32.116513014 CET53609378.8.8.8192.168.1.102
Oct 31, 2020 22:58:32.328479052 CET6536553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:32.352600098 CET53653658.8.8.8192.168.1.102
Oct 31, 2020 22:58:32.577069998 CET6007053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:32.601262093 CET53600708.8.8.8192.168.1.102
Oct 31, 2020 22:58:32.822932959 CET5951253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:32.847043991 CET53595128.8.8.8192.168.1.102
Oct 31, 2020 22:58:33.063493013 CET5810553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:33.087570906 CET53581058.8.8.8192.168.1.102
Oct 31, 2020 22:58:33.311418056 CET6111753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:33.335694075 CET53611178.8.8.8192.168.1.102
Oct 31, 2020 22:58:33.552701950 CET5521053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:33.585167885 CET53552108.8.8.8192.168.1.102
Oct 31, 2020 22:58:33.798768044 CET5729753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:33.822961092 CET53572978.8.8.8192.168.1.102
Oct 31, 2020 22:58:34.033284903 CET5439353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:34.057393074 CET53543938.8.8.8192.168.1.102
Oct 31, 2020 22:58:34.284466982 CET5264453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:34.317047119 CET53526448.8.8.8192.168.1.102
Oct 31, 2020 22:58:34.526227951 CET5451553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:34.550215006 CET53545158.8.8.8192.168.1.102
Oct 31, 2020 22:58:34.758867025 CET6032953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:34.782953978 CET53603298.8.8.8192.168.1.102
Oct 31, 2020 22:58:34.997220993 CET5099853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:35.021348953 CET53509988.8.8.8192.168.1.102
Oct 31, 2020 22:58:35.243607044 CET5568853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:35.267817020 CET53556888.8.8.8192.168.1.102
Oct 31, 2020 22:58:35.494707108 CET5768853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:35.518752098 CET53576888.8.8.8192.168.1.102
Oct 31, 2020 22:58:35.738225937 CET6278353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:35.762243032 CET53627838.8.8.8192.168.1.102
Oct 31, 2020 22:58:35.982425928 CET5259453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:36.014950037 CET53525948.8.8.8192.168.1.102
Oct 31, 2020 22:58:36.230536938 CET5973953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:36.254667044 CET53597398.8.8.8192.168.1.102
Oct 31, 2020 22:58:36.482888937 CET5869553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:36.506968975 CET53586958.8.8.8192.168.1.102
Oct 31, 2020 22:58:36.721333981 CET5680753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:36.745426893 CET53568078.8.8.8192.168.1.102
Oct 31, 2020 22:58:36.972196102 CET5838953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:36.996511936 CET53583898.8.8.8192.168.1.102
Oct 31, 2020 22:58:37.216810942 CET6504653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:37.240936041 CET53650468.8.8.8192.168.1.102
Oct 31, 2020 22:58:37.462160110 CET6324453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:37.486321926 CET53632448.8.8.8192.168.1.102
Oct 31, 2020 22:58:37.731558084 CET6527353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:37.755875111 CET53652738.8.8.8192.168.1.102
Oct 31, 2020 22:58:38.001010895 CET5688653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:38.025197029 CET53568868.8.8.8192.168.1.102
Oct 31, 2020 22:58:38.255713940 CET5980453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:38.279748917 CET53598048.8.8.8192.168.1.102
Oct 31, 2020 22:58:38.510190010 CET6076853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:38.542990923 CET53607688.8.8.8192.168.1.102
Oct 31, 2020 22:58:38.794533014 CET4931853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:38.818690062 CET53493188.8.8.8192.168.1.102
Oct 31, 2020 22:58:39.037404060 CET6469253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:39.061516047 CET53646928.8.8.8192.168.1.102
Oct 31, 2020 22:58:39.291409016 CET6020353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:39.315632105 CET53602038.8.8.8192.168.1.102
Oct 31, 2020 22:58:39.541771889 CET4983653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:39.565871954 CET53498368.8.8.8192.168.1.102
Oct 31, 2020 22:58:39.806390047 CET5072553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:39.838660955 CET53507258.8.8.8192.168.1.102
Oct 31, 2020 22:58:40.071918964 CET4931153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:40.104702950 CET53493118.8.8.8192.168.1.102
Oct 31, 2020 22:58:40.319116116 CET6359253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:40.343267918 CET53635928.8.8.8192.168.1.102
Oct 31, 2020 22:58:40.565732956 CET6382153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:40.589935064 CET53638218.8.8.8192.168.1.102
Oct 31, 2020 22:58:40.821423054 CET6360553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:40.854068041 CET53636058.8.8.8192.168.1.102
Oct 31, 2020 22:58:41.094196081 CET5705853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:41.118374109 CET53570588.8.8.8192.168.1.102
Oct 31, 2020 22:58:41.347328901 CET6183653192.168.1.1028.8.8.8
Oct 31, 2020 22:58:41.371474028 CET53618368.8.8.8192.168.1.102
Oct 31, 2020 22:58:41.614700079 CET5118453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:41.638802052 CET53511848.8.8.8192.168.1.102
Oct 31, 2020 22:58:41.860361099 CET5303053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:41.884532928 CET53530308.8.8.8192.168.1.102
Oct 31, 2020 22:58:42.106020927 CET5752053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:42.138346910 CET53575208.8.8.8192.168.1.102
Oct 31, 2020 22:58:42.351480007 CET4998153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:42.375706911 CET53499818.8.8.8192.168.1.102
Oct 31, 2020 22:58:42.598376036 CET5544053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:42.622498989 CET53554408.8.8.8192.168.1.102
Oct 31, 2020 22:58:42.837658882 CET5873053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:42.861886024 CET53587308.8.8.8192.168.1.102
Oct 31, 2020 22:58:43.114191055 CET5687453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:43.138371944 CET53568748.8.8.8192.168.1.102
Oct 31, 2020 22:58:43.360255003 CET4991153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:43.384397984 CET53499118.8.8.8192.168.1.102
Oct 31, 2020 22:58:43.608668089 CET5845353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:43.632755041 CET53584538.8.8.8192.168.1.102
Oct 31, 2020 22:58:43.854275942 CET6057853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:43.878500938 CET53605788.8.8.8192.168.1.102
Oct 31, 2020 22:58:44.101288080 CET6257153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:44.125572920 CET53625718.8.8.8192.168.1.102
Oct 31, 2020 22:58:44.347199917 CET6547753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:44.371329069 CET53654778.8.8.8192.168.1.102
Oct 31, 2020 22:58:44.588150024 CET5373553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:44.612421989 CET53537358.8.8.8192.168.1.102
Oct 31, 2020 22:58:44.946187019 CET6340553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:44.970352888 CET53634058.8.8.8192.168.1.102
Oct 31, 2020 22:58:45.183635950 CET5870353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:45.207782030 CET53587038.8.8.8192.168.1.102
Oct 31, 2020 22:58:45.422210932 CET5013453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:45.446420908 CET53501348.8.8.8192.168.1.102
Oct 31, 2020 22:58:45.668564081 CET6476553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:45.692790031 CET53647658.8.8.8192.168.1.102
Oct 31, 2020 22:58:46.283267021 CET5334253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:46.315936089 CET53533428.8.8.8192.168.1.102
Oct 31, 2020 22:58:47.013602972 CET6513553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:47.037919044 CET53651358.8.8.8192.168.1.102
Oct 31, 2020 22:58:47.287213087 CET5449853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:47.311530113 CET53544988.8.8.8192.168.1.102
Oct 31, 2020 22:58:47.583743095 CET5751853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:47.607892036 CET53575188.8.8.8192.168.1.102
Oct 31, 2020 22:58:47.867212057 CET6245253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:47.891453981 CET53624528.8.8.8192.168.1.102
Oct 31, 2020 22:58:48.120528936 CET5881953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:48.144661903 CET53588198.8.8.8192.168.1.102
Oct 31, 2020 22:58:48.375437975 CET5708353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:48.399682999 CET53570838.8.8.8192.168.1.102
Oct 31, 2020 22:58:48.629600048 CET6481153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:48.653717995 CET53648118.8.8.8192.168.1.102
Oct 31, 2020 22:58:48.879422903 CET6551053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:48.903634071 CET53655108.8.8.8192.168.1.102
Oct 31, 2020 22:58:49.132314920 CET5555953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:49.156527996 CET53555598.8.8.8192.168.1.102
Oct 31, 2020 22:58:49.378151894 CET5693053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:49.402359962 CET53569308.8.8.8192.168.1.102
Oct 31, 2020 22:58:49.626338959 CET5218053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:49.650624990 CET53521808.8.8.8192.168.1.102
Oct 31, 2020 22:58:49.879075050 CET4991353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:49.903287888 CET53499138.8.8.8192.168.1.102
Oct 31, 2020 22:58:50.131946087 CET6430453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:50.156435966 CET53643048.8.8.8192.168.1.102
Oct 31, 2020 22:58:50.377088070 CET5911753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:50.401303053 CET53591178.8.8.8192.168.1.102
Oct 31, 2020 22:58:50.643929005 CET5129753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:50.668054104 CET53512978.8.8.8192.168.1.102
Oct 31, 2020 22:58:50.914680004 CET5246553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:50.938851118 CET53524658.8.8.8192.168.1.102
Oct 31, 2020 22:58:51.172966003 CET6395353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:51.197154045 CET53639538.8.8.8192.168.1.102
Oct 31, 2020 22:58:51.424407005 CET5630253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:51.448590994 CET53563028.8.8.8192.168.1.102
Oct 31, 2020 22:58:51.688716888 CET5671753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:51.712738037 CET53567178.8.8.8192.168.1.102
Oct 31, 2020 22:58:51.925961971 CET5025553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:51.958904982 CET53502558.8.8.8192.168.1.102
Oct 31, 2020 22:58:52.186191082 CET5987053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:52.210366011 CET53598708.8.8.8192.168.1.102
Oct 31, 2020 22:58:52.426301003 CET6223453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:52.450582981 CET53622348.8.8.8192.168.1.102
Oct 31, 2020 22:58:52.672508001 CET6020753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:52.696655035 CET53602078.8.8.8192.168.1.102
Oct 31, 2020 22:58:52.926002026 CET5742353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:52.950433969 CET53574238.8.8.8192.168.1.102
Oct 31, 2020 22:58:53.175318003 CET6429153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:53.199438095 CET53642918.8.8.8192.168.1.102
Oct 31, 2020 22:58:53.464314938 CET4953053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:53.488398075 CET53495308.8.8.8192.168.1.102
Oct 31, 2020 22:58:53.706046104 CET5630953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:53.730273962 CET53563098.8.8.8192.168.1.102
Oct 31, 2020 22:58:53.961328030 CET6157553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:53.985579967 CET53615758.8.8.8192.168.1.102
Oct 31, 2020 22:58:54.243802071 CET5960453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:54.268002033 CET53596048.8.8.8192.168.1.102
Oct 31, 2020 22:58:54.499098063 CET6500853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:54.523300886 CET53650088.8.8.8192.168.1.102
Oct 31, 2020 22:58:54.777808905 CET6206353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:54.801896095 CET53620638.8.8.8192.168.1.102
Oct 31, 2020 22:58:55.033621073 CET6022453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:55.057796955 CET53602248.8.8.8192.168.1.102
Oct 31, 2020 22:58:55.324409008 CET6259753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:55.348665953 CET53625978.8.8.8192.168.1.102
Oct 31, 2020 22:58:55.567173958 CET5571753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:55.591279030 CET53557178.8.8.8192.168.1.102
Oct 31, 2020 22:58:55.818265915 CET5885553192.168.1.1028.8.8.8
Oct 31, 2020 22:58:55.842416048 CET53588558.8.8.8192.168.1.102
Oct 31, 2020 22:58:56.062531948 CET5954453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:56.086709023 CET53595448.8.8.8192.168.1.102
Oct 31, 2020 22:58:56.301527977 CET5214753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:56.325673103 CET53521478.8.8.8192.168.1.102
Oct 31, 2020 22:58:56.595185041 CET5705453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:56.619375944 CET53570548.8.8.8192.168.1.102
Oct 31, 2020 22:58:56.899789095 CET5485253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:56.923993111 CET53548528.8.8.8192.168.1.102
Oct 31, 2020 22:58:57.158828020 CET6097253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:57.183202982 CET53609728.8.8.8192.168.1.102
Oct 31, 2020 22:58:57.396714926 CET5075153192.168.1.1028.8.8.8
Oct 31, 2020 22:58:57.420866966 CET53507518.8.8.8192.168.1.102
Oct 31, 2020 22:58:57.649252892 CET5474053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:57.673403978 CET53547408.8.8.8192.168.1.102
Oct 31, 2020 22:58:57.914612055 CET5521453192.168.1.1028.8.8.8
Oct 31, 2020 22:58:57.938954115 CET53552148.8.8.8192.168.1.102
Oct 31, 2020 22:58:58.198401928 CET5623353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:58.222671986 CET53562338.8.8.8192.168.1.102
Oct 31, 2020 22:58:58.474261045 CET6050753192.168.1.1028.8.8.8
Oct 31, 2020 22:58:58.498405933 CET53605078.8.8.8192.168.1.102
Oct 31, 2020 22:58:58.724769115 CET6470853192.168.1.1028.8.8.8
Oct 31, 2020 22:58:58.749001026 CET53647088.8.8.8192.168.1.102
Oct 31, 2020 22:58:58.974025965 CET5261953192.168.1.1028.8.8.8
Oct 31, 2020 22:58:58.998239040 CET53526198.8.8.8192.168.1.102
Oct 31, 2020 22:58:59.221676111 CET5855253192.168.1.1028.8.8.8
Oct 31, 2020 22:58:59.245881081 CET53585528.8.8.8192.168.1.102
Oct 31, 2020 22:58:59.460984945 CET5949053192.168.1.1028.8.8.8
Oct 31, 2020 22:58:59.485228062 CET53594908.8.8.8192.168.1.102
Oct 31, 2020 22:58:59.717564106 CET5887353192.168.1.1028.8.8.8
Oct 31, 2020 22:58:59.741791010 CET53588738.8.8.8192.168.1.102
Oct 31, 2020 22:59:00.027281046 CET5654953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:00.051398993 CET53565498.8.8.8192.168.1.102
Oct 31, 2020 22:59:00.317502022 CET5585553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:00.341680050 CET53558558.8.8.8192.168.1.102
Oct 31, 2020 22:59:00.571221113 CET5657953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:00.595423937 CET53565798.8.8.8192.168.1.102
Oct 31, 2020 22:59:00.818341970 CET6279353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:00.843266010 CET53627938.8.8.8192.168.1.102
Oct 31, 2020 22:59:01.097857952 CET5936753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:01.130239964 CET53593678.8.8.8192.168.1.102
Oct 31, 2020 22:59:01.392920017 CET5426853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:01.416995049 CET53542688.8.8.8192.168.1.102
Oct 31, 2020 22:59:01.633388996 CET6493653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:01.657594919 CET53649368.8.8.8192.168.1.102
Oct 31, 2020 22:59:01.888259888 CET5105353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:01.912434101 CET53510538.8.8.8192.168.1.102
Oct 31, 2020 22:59:02.132716894 CET6198253192.168.1.1028.8.8.8
Oct 31, 2020 22:59:02.156886101 CET53619828.8.8.8192.168.1.102
Oct 31, 2020 22:59:02.383390903 CET5055853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:02.407545090 CET53505588.8.8.8192.168.1.102
Oct 31, 2020 22:59:02.629148006 CET5201753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:02.653281927 CET53520178.8.8.8192.168.1.102
Oct 31, 2020 22:59:02.892231941 CET4944153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:02.916342974 CET53494418.8.8.8192.168.1.102
Oct 31, 2020 22:59:03.190824032 CET6216453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:03.214942932 CET53621648.8.8.8192.168.1.102
Oct 31, 2020 22:59:03.471592903 CET5357053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:03.495737076 CET53535708.8.8.8192.168.1.102
Oct 31, 2020 22:59:03.724661112 CET5448453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:03.748977900 CET53544848.8.8.8192.168.1.102
Oct 31, 2020 22:59:03.971355915 CET5775953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:03.995729923 CET53577598.8.8.8192.168.1.102
Oct 31, 2020 22:59:04.219145060 CET5589453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:04.243385077 CET53558948.8.8.8192.168.1.102
Oct 31, 2020 22:59:04.520612955 CET5999153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:04.544728994 CET53599918.8.8.8192.168.1.102
Oct 31, 2020 22:59:04.759471893 CET6195553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:04.783665895 CET53619558.8.8.8192.168.1.102
Oct 31, 2020 22:59:05.006222010 CET6088653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:05.030752897 CET53608868.8.8.8192.168.1.102
Oct 31, 2020 22:59:05.248702049 CET5084953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:05.273355961 CET53508498.8.8.8192.168.1.102
Oct 31, 2020 22:59:05.498981953 CET6498353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:05.523180008 CET53649838.8.8.8192.168.1.102
Oct 31, 2020 22:59:05.741180897 CET5796953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:05.765384912 CET53579698.8.8.8192.168.1.102
Oct 31, 2020 22:59:05.980118990 CET6360153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:06.004417896 CET53636018.8.8.8192.168.1.102
Oct 31, 2020 22:59:06.281059027 CET6063453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:06.305275917 CET53606348.8.8.8192.168.1.102
Oct 31, 2020 22:59:06.544899940 CET5472853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:06.569180012 CET53547288.8.8.8192.168.1.102
Oct 31, 2020 22:59:06.797962904 CET5553853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:06.822242975 CET53555388.8.8.8192.168.1.102
Oct 31, 2020 22:59:07.054301023 CET5475353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:07.078536034 CET53547538.8.8.8192.168.1.102
Oct 31, 2020 22:59:07.338673115 CET6388953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:07.371146917 CET53638898.8.8.8192.168.1.102
Oct 31, 2020 22:59:07.599427938 CET5065353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:07.623533964 CET53506538.8.8.8192.168.1.102
Oct 31, 2020 22:59:07.848397970 CET5980353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:07.872580051 CET53598038.8.8.8192.168.1.102
Oct 31, 2020 22:59:08.113929033 CET5518753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:08.138168097 CET53551878.8.8.8192.168.1.102
Oct 31, 2020 22:59:08.353817940 CET5965453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:08.378213882 CET53596548.8.8.8192.168.1.102
Oct 31, 2020 22:59:08.590481997 CET5377453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:08.614651918 CET53537748.8.8.8192.168.1.102
Oct 31, 2020 22:59:08.840511084 CET5023153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:08.864626884 CET53502318.8.8.8192.168.1.102
Oct 31, 2020 22:59:09.117484093 CET4963853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:09.141653061 CET53496388.8.8.8192.168.1.102
Oct 31, 2020 22:59:09.362986088 CET6147053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:09.387201071 CET53614708.8.8.8192.168.1.102
Oct 31, 2020 22:59:09.626601934 CET6118253192.168.1.1028.8.8.8
Oct 31, 2020 22:59:09.650854111 CET53611828.8.8.8192.168.1.102
Oct 31, 2020 22:59:09.909435034 CET5422953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:09.933723927 CET53542298.8.8.8192.168.1.102
Oct 31, 2020 22:59:10.157074928 CET5749353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:10.181204081 CET53574938.8.8.8192.168.1.102
Oct 31, 2020 22:59:10.436167955 CET5452253192.168.1.1028.8.8.8
Oct 31, 2020 22:59:10.460338116 CET53545228.8.8.8192.168.1.102
Oct 31, 2020 22:59:10.713459015 CET6517853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:10.737663031 CET53651788.8.8.8192.168.1.102
Oct 31, 2020 22:59:10.969902992 CET5352053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:10.994184017 CET53535208.8.8.8192.168.1.102
Oct 31, 2020 22:59:11.203850985 CET5653853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:11.228014946 CET53565388.8.8.8192.168.1.102
Oct 31, 2020 22:59:11.456494093 CET4937253192.168.1.1028.8.8.8
Oct 31, 2020 22:59:11.480654001 CET53493728.8.8.8192.168.1.102
Oct 31, 2020 22:59:11.703495026 CET6324553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:11.727776051 CET53632458.8.8.8192.168.1.102
Oct 31, 2020 22:59:11.937109947 CET6060353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:11.961415052 CET53606038.8.8.8192.168.1.102
Oct 31, 2020 22:59:12.215946913 CET5558753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:12.240103006 CET53555878.8.8.8192.168.1.102
Oct 31, 2020 22:59:12.463819981 CET6275553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:12.487976074 CET53627558.8.8.8192.168.1.102
Oct 31, 2020 22:59:12.703722954 CET6020053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:12.727832079 CET53602008.8.8.8192.168.1.102
Oct 31, 2020 22:59:12.956382990 CET4949553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:12.980635881 CET53494958.8.8.8192.168.1.102
Oct 31, 2020 22:59:13.253719091 CET5129153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:13.277864933 CET53512918.8.8.8192.168.1.102
Oct 31, 2020 22:59:13.534048080 CET5874953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:13.558196068 CET53587498.8.8.8192.168.1.102
Oct 31, 2020 22:59:13.813366890 CET5348453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:13.837476969 CET53534848.8.8.8192.168.1.102
Oct 31, 2020 22:59:14.054671049 CET6129053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:14.078919888 CET53612908.8.8.8192.168.1.102
Oct 31, 2020 22:59:14.301342964 CET5572953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:14.325351000 CET53557298.8.8.8192.168.1.102
Oct 31, 2020 22:59:14.550076008 CET6503053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:14.582607031 CET53650308.8.8.8192.168.1.102
Oct 31, 2020 22:59:14.801049948 CET6472453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:14.825131893 CET53647248.8.8.8192.168.1.102
Oct 31, 2020 22:59:15.041461945 CET6497753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:15.065736055 CET53649778.8.8.8192.168.1.102
Oct 31, 2020 22:59:15.292025089 CET5988153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:15.316190958 CET53598818.8.8.8192.168.1.102
Oct 31, 2020 22:59:15.566790104 CET6267853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:15.591017008 CET53626788.8.8.8192.168.1.102
Oct 31, 2020 22:59:15.808876038 CET5660453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:15.833029032 CET53566048.8.8.8192.168.1.102
Oct 31, 2020 22:59:16.059195042 CET5102553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:16.083314896 CET53510258.8.8.8192.168.1.102
Oct 31, 2020 22:59:16.326210976 CET6444253192.168.1.1028.8.8.8
Oct 31, 2020 22:59:16.350312948 CET53644428.8.8.8192.168.1.102
Oct 31, 2020 22:59:16.595269918 CET5537653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:16.619399071 CET53553768.8.8.8192.168.1.102
Oct 31, 2020 22:59:16.840065002 CET5350453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:16.864172935 CET53535048.8.8.8192.168.1.102
Oct 31, 2020 22:59:17.121419907 CET5402153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:17.145641088 CET53540218.8.8.8192.168.1.102
Oct 31, 2020 22:59:17.416896105 CET4972853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:17.441052914 CET53497288.8.8.8192.168.1.102
Oct 31, 2020 22:59:17.658880949 CET5160653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:17.682924032 CET53516068.8.8.8192.168.1.102
Oct 31, 2020 22:59:17.905126095 CET5852653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:17.929291964 CET53585268.8.8.8192.168.1.102
Oct 31, 2020 22:59:18.149868011 CET5975653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:18.174017906 CET53597568.8.8.8192.168.1.102
Oct 31, 2020 22:59:18.387938976 CET6470853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:18.412138939 CET53647088.8.8.8192.168.1.102
Oct 31, 2020 22:59:18.655294895 CET5952753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:18.679408073 CET53595278.8.8.8192.168.1.102
Oct 31, 2020 22:59:18.912914038 CET6321653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:18.937150955 CET53632168.8.8.8192.168.1.102
Oct 31, 2020 22:59:19.161531925 CET5035053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:19.185652971 CET53503508.8.8.8192.168.1.102
Oct 31, 2020 22:59:19.434782982 CET5874153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:19.459067106 CET53587418.8.8.8192.168.1.102
Oct 31, 2020 22:59:19.705502033 CET6378953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:19.729603052 CET53637898.8.8.8192.168.1.102
Oct 31, 2020 22:59:19.968070030 CET5968153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:19.992373943 CET53596818.8.8.8192.168.1.102
Oct 31, 2020 22:59:20.268593073 CET6295953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:20.292696953 CET53629598.8.8.8192.168.1.102
Oct 31, 2020 22:59:20.569405079 CET5230253192.168.1.1028.8.8.8
Oct 31, 2020 22:59:20.593558073 CET53523028.8.8.8192.168.1.102
Oct 31, 2020 22:59:20.806374073 CET5640653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:20.830477953 CET53564068.8.8.8192.168.1.102
Oct 31, 2020 22:59:21.048388004 CET5086753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:21.072523117 CET53508678.8.8.8192.168.1.102
Oct 31, 2020 22:59:21.297161102 CET5027853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:21.321295977 CET53502788.8.8.8192.168.1.102
Oct 31, 2020 22:59:21.546818018 CET6444653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:21.570874929 CET53644468.8.8.8192.168.1.102
Oct 31, 2020 22:59:21.814594030 CET5657453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:21.838738918 CET53565748.8.8.8192.168.1.102
Oct 31, 2020 22:59:22.097029924 CET4980353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:22.121248960 CET53498038.8.8.8192.168.1.102
Oct 31, 2020 22:59:22.349307060 CET6396353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:22.373425007 CET53639638.8.8.8192.168.1.102
Oct 31, 2020 22:59:22.612602949 CET5967053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:22.636688948 CET53596708.8.8.8192.168.1.102
Oct 31, 2020 22:59:22.854568005 CET6165853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:22.878793955 CET53616588.8.8.8192.168.1.102
Oct 31, 2020 22:59:23.133879900 CET5801253192.168.1.1028.8.8.8
Oct 31, 2020 22:59:23.158044100 CET53580128.8.8.8192.168.1.102
Oct 31, 2020 22:59:23.375050068 CET6065453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:23.399208069 CET53606548.8.8.8192.168.1.102
Oct 31, 2020 22:59:23.630074978 CET5760353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:23.654383898 CET53576038.8.8.8192.168.1.102
Oct 31, 2020 22:59:23.884705067 CET5076553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:23.908905983 CET53507658.8.8.8192.168.1.102
Oct 31, 2020 22:59:24.130032063 CET5792053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:24.154334068 CET53579208.8.8.8192.168.1.102
Oct 31, 2020 22:59:24.379892111 CET5773853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:24.403971910 CET53577388.8.8.8192.168.1.102
Oct 31, 2020 22:59:24.622478962 CET5298953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:24.646840096 CET53529898.8.8.8192.168.1.102
Oct 31, 2020 22:59:24.888324022 CET6483653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:24.912674904 CET53648368.8.8.8192.168.1.102
Oct 31, 2020 22:59:25.153604031 CET5115653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:25.186151981 CET53511568.8.8.8192.168.1.102
Oct 31, 2020 22:59:25.405442953 CET5785853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:25.429682970 CET53578588.8.8.8192.168.1.102
Oct 31, 2020 22:59:25.653238058 CET5156653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:25.677448988 CET53515668.8.8.8192.168.1.102
Oct 31, 2020 22:59:25.903892994 CET5878053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:25.928066015 CET53587808.8.8.8192.168.1.102
Oct 31, 2020 22:59:26.160885096 CET5588853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:26.185185909 CET53558888.8.8.8192.168.1.102
Oct 31, 2020 22:59:26.416438103 CET6223853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:26.440584898 CET53622388.8.8.8192.168.1.102
Oct 31, 2020 22:59:26.655599117 CET5749153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:26.679734945 CET53574918.8.8.8192.168.1.102
Oct 31, 2020 22:59:26.904875040 CET6237753192.168.1.1028.8.8.8
Oct 31, 2020 22:59:26.929169893 CET53623778.8.8.8192.168.1.102
Oct 31, 2020 22:59:27.140017033 CET6111153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:27.164298058 CET53611118.8.8.8192.168.1.102
Oct 31, 2020 22:59:27.378006935 CET5495153192.168.1.1028.8.8.8
Oct 31, 2020 22:59:27.402121067 CET53549518.8.8.8192.168.1.102
Oct 31, 2020 22:59:27.631149054 CET6462653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:27.655303001 CET53646268.8.8.8192.168.1.102
Oct 31, 2020 22:59:27.869113922 CET5790453192.168.1.1028.8.8.8
Oct 31, 2020 22:59:27.893304110 CET53579048.8.8.8192.168.1.102
Oct 31, 2020 22:59:28.103110075 CET5432653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:28.127270937 CET53543268.8.8.8192.168.1.102
Oct 31, 2020 22:59:28.354991913 CET5535653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:28.379195929 CET53553568.8.8.8192.168.1.102
Oct 31, 2020 22:59:28.619333029 CET6061953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:28.643476963 CET53606198.8.8.8192.168.1.102
Oct 31, 2020 22:59:28.852669954 CET6431353192.168.1.1028.8.8.8
Oct 31, 2020 22:59:28.876889944 CET53643138.8.8.8192.168.1.102
Oct 31, 2020 22:59:29.107744932 CET5033553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:29.131956100 CET53503358.8.8.8192.168.1.102
Oct 31, 2020 22:59:29.349948883 CET6330853192.168.1.1028.8.8.8
Oct 31, 2020 22:59:29.374089956 CET53633088.8.8.8192.168.1.102
Oct 31, 2020 22:59:29.604275942 CET6444653192.168.1.1028.8.8.8
Oct 31, 2020 22:59:29.628443956 CET53644468.8.8.8192.168.1.102
Oct 31, 2020 22:59:29.926681042 CET5333553192.168.1.1028.8.8.8
Oct 31, 2020 22:59:29.951117039 CET53533358.8.8.8192.168.1.102
Oct 31, 2020 22:59:30.187779903 CET5575953192.168.1.1028.8.8.8
Oct 31, 2020 22:59:30.212205887 CET53557598.8.8.8192.168.1.102
Oct 31, 2020 22:59:30.439661980 CET5769053192.168.1.1028.8.8.8
Oct 31, 2020 22:59:30.463994980 CET53576908.8.8.8192.168.1.102

DNS Queries

TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
Oct 31, 2020 22:57:58.356106997 CET192.168.1.1028.8.8.80x209Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:57:58.659580946 CET192.168.1.1028.8.8.80x1c29Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:57:58.942051888 CET192.168.1.1028.8.8.80x87e4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:57:59.236418009 CET192.168.1.1028.8.8.80x8f04Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:57:59.496068954 CET192.168.1.1028.8.8.80x910fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:57:59.761670113 CET192.168.1.1028.8.8.80x9140Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:00.019314051 CET192.168.1.1028.8.8.80x4e76Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:00.294744015 CET192.168.1.1028.8.8.80x7830Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:00.542402983 CET192.168.1.1028.8.8.80xf1a1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:00.791368961 CET192.168.1.1028.8.8.80x221cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:01.040200949 CET192.168.1.1028.8.8.80xcf99Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:01.315272093 CET192.168.1.1028.8.8.80x2ac9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:01.564667940 CET192.168.1.1028.8.8.80xa10dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:01.817579031 CET192.168.1.1028.8.8.80xee71Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:02.068314075 CET192.168.1.1028.8.8.80xb733Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:02.332345009 CET192.168.1.1028.8.8.80xf8e8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:02.601298094 CET192.168.1.1028.8.8.80x1d68Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:02.866518021 CET192.168.1.1028.8.8.80x2f73Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:03.309684038 CET192.168.1.1028.8.8.80x199eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:03.552083015 CET192.168.1.1028.8.8.80x1e49Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:03.811285973 CET192.168.1.1028.8.8.80x58baStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:04.077286959 CET192.168.1.1028.8.8.80xe2a4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:04.325582981 CET192.168.1.1028.8.8.80xb3e4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:04.576935053 CET192.168.1.1028.8.8.80xf2aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:04.842366934 CET192.168.1.1028.8.8.80x3f86Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:05.088447094 CET192.168.1.1028.8.8.80x54cfStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:05.331859112 CET192.168.1.1028.8.8.80x4840Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:05.575695038 CET192.168.1.1028.8.8.80xfc09Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:05.828222990 CET192.168.1.1028.8.8.80xa98Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:06.113827944 CET192.168.1.1028.8.8.80x5ed1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:06.370800972 CET192.168.1.1028.8.8.80x7eefStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:06.629591942 CET192.168.1.1028.8.8.80x3562Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:06.895286083 CET192.168.1.1028.8.8.80xdd63Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:07.142600060 CET192.168.1.1028.8.8.80x2f0aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:07.391448975 CET192.168.1.1028.8.8.80x80e8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:07.643035889 CET192.168.1.1028.8.8.80xfe10Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:07.887782097 CET192.168.1.1028.8.8.80xf008Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:08.174350977 CET192.168.1.1028.8.8.80x86dbStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:08.437330961 CET192.168.1.1028.8.8.80x7dd2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:08.670663118 CET192.168.1.1028.8.8.80x4f62Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:08.916201115 CET192.168.1.1028.8.8.80xb4bbStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:09.166476011 CET192.168.1.1028.8.8.80xa8d8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:09.410628080 CET192.168.1.1028.8.8.80xa29dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:09.655642986 CET192.168.1.1028.8.8.80xcb7fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:09.901715994 CET192.168.1.1028.8.8.80xc6cdStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:10.241559029 CET192.168.1.1028.8.8.80xc922Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:11.119221926 CET192.168.1.1028.8.8.80xd52cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:11.486649036 CET192.168.1.1028.8.8.80xcc7bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:12.063915014 CET192.168.1.1028.8.8.80xf93bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:12.360224962 CET192.168.1.1028.8.8.80xf377Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:12.638248920 CET192.168.1.1028.8.8.80x376dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:12.888031006 CET192.168.1.1028.8.8.80x7db3Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:13.152443886 CET192.168.1.1028.8.8.80x6114Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:13.389481068 CET192.168.1.1028.8.8.80x3f83Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:13.637166977 CET192.168.1.1028.8.8.80x54a4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:13.882484913 CET192.168.1.1028.8.8.80xf798Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:14.129964113 CET192.168.1.1028.8.8.80xf438Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:14.379251003 CET192.168.1.1028.8.8.80xa1c6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:14.622591972 CET192.168.1.1028.8.8.80xeb4bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:14.865195990 CET192.168.1.1028.8.8.80x69feStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:15.108350039 CET192.168.1.1028.8.8.80xe3baStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:15.339456081 CET192.168.1.1028.8.8.80x3f9bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:15.587194920 CET192.168.1.1028.8.8.80x2f15Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:15.833266973 CET192.168.1.1028.8.8.80x361cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:16.083573103 CET192.168.1.1028.8.8.80x446bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:16.334146023 CET192.168.1.1028.8.8.80x2fbcStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:16.581343889 CET192.168.1.1028.8.8.80xdf8bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:16.854422092 CET192.168.1.1028.8.8.80x2d1cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:17.094836950 CET192.168.1.1028.8.8.80xa583Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:17.352400064 CET192.168.1.1028.8.8.80x9e56Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:17.597307920 CET192.168.1.1028.8.8.80xf4e2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:17.848023891 CET192.168.1.1028.8.8.80xfe7bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:18.092550039 CET192.168.1.1028.8.8.80xd3ddStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:18.337786913 CET192.168.1.1028.8.8.80xa28fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:18.574656010 CET192.168.1.1028.8.8.80xc9b7Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:18.816879034 CET192.168.1.1028.8.8.80x889Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:19.060357094 CET192.168.1.1028.8.8.80x6cd2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:19.300507069 CET192.168.1.1028.8.8.80x34f1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:19.550453901 CET192.168.1.1028.8.8.80x8810Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:19.791575909 CET192.168.1.1028.8.8.80x8e1aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:20.035082102 CET192.168.1.1028.8.8.80xa97Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:20.282563925 CET192.168.1.1028.8.8.80xd7aaStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:20.531861067 CET192.168.1.1028.8.8.80xcf33Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:20.780188084 CET192.168.1.1028.8.8.80x6917Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:21.034014940 CET192.168.1.1028.8.8.80xa518Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:21.288301945 CET192.168.1.1028.8.8.80xea3fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:21.531739950 CET192.168.1.1028.8.8.80xd4a5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:21.775712013 CET192.168.1.1028.8.8.80xf508Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:22.013997078 CET192.168.1.1028.8.8.80x13bdStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:22.249692917 CET192.168.1.1028.8.8.80x1cb8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:22.496064901 CET192.168.1.1028.8.8.80xaba6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:22.754255056 CET192.168.1.1028.8.8.80xa062Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:22.987730980 CET192.168.1.1028.8.8.80x37dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:23.237608910 CET192.168.1.1028.8.8.80x8c06Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:23.484697104 CET192.168.1.1028.8.8.80x2ad6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:23.720062017 CET192.168.1.1028.8.8.80xe9c0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:23.952507019 CET192.168.1.1028.8.8.80xfbd4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:24.201069117 CET192.168.1.1028.8.8.80xdf1eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:24.452256918 CET192.168.1.1028.8.8.80x2d94Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:24.705614090 CET192.168.1.1028.8.8.80xd9c4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:25.002012968 CET192.168.1.1028.8.8.80xcd37Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:25.269138098 CET192.168.1.1028.8.8.80xcbbfStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:25.519251108 CET192.168.1.1028.8.8.80x18b4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:25.770019054 CET192.168.1.1028.8.8.80xcbfdStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:26.021261930 CET192.168.1.1028.8.8.80xf2e4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:26.331233978 CET192.168.1.1028.8.8.80xaf5cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:26.566318989 CET192.168.1.1028.8.8.80x8a2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:26.813718081 CET192.168.1.1028.8.8.80x3739Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:27.056814909 CET192.168.1.1028.8.8.80xdf89Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:27.312645912 CET192.168.1.1028.8.8.80xc368Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:27.611253977 CET192.168.1.1028.8.8.80xd183Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:27.957024097 CET192.168.1.1028.8.8.80x9e40Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:28.633605003 CET192.168.1.1028.8.8.80x6d6eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:28.967077017 CET192.168.1.1028.8.8.80x8b6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:29.646918058 CET192.168.1.1028.8.8.80x30c9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:29.896704912 CET192.168.1.1028.8.8.80x6c2dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:30.132014036 CET192.168.1.1028.8.8.80x8aa9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:30.377209902 CET192.168.1.1028.8.8.80xcd55Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:30.629019022 CET192.168.1.1028.8.8.80xaacStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:30.870219946 CET192.168.1.1028.8.8.80xc673Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:31.118225098 CET192.168.1.1028.8.8.80x40bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:31.351303101 CET192.168.1.1028.8.8.80xaefStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:31.599716902 CET192.168.1.1028.8.8.80xe282Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:31.847336054 CET192.168.1.1028.8.8.80x896Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:32.092302084 CET192.168.1.1028.8.8.80x57e6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:32.328479052 CET192.168.1.1028.8.8.80xa342Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:32.577069998 CET192.168.1.1028.8.8.80x9b01Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:32.822932959 CET192.168.1.1028.8.8.80x329Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:33.063493013 CET192.168.1.1028.8.8.80x4d3aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:33.311418056 CET192.168.1.1028.8.8.80xd08aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:33.552701950 CET192.168.1.1028.8.8.80x3feeStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:33.798768044 CET192.168.1.1028.8.8.80x6d9bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:34.033284903 CET192.168.1.1028.8.8.80x197fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:34.284466982 CET192.168.1.1028.8.8.80xfe1dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:34.526227951 CET192.168.1.1028.8.8.80x7344Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:34.758867025 CET192.168.1.1028.8.8.80xec22Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:34.997220993 CET192.168.1.1028.8.8.80x6f53Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:35.243607044 CET192.168.1.1028.8.8.80x3c16Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:35.494707108 CET192.168.1.1028.8.8.80x744Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:35.738225937 CET192.168.1.1028.8.8.80x4b88Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:35.982425928 CET192.168.1.1028.8.8.80xac75Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:36.230536938 CET192.168.1.1028.8.8.80xb3adStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:36.482888937 CET192.168.1.1028.8.8.80x6451Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:36.721333981 CET192.168.1.1028.8.8.80x9c5bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:36.972196102 CET192.168.1.1028.8.8.80x2ef1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:37.216810942 CET192.168.1.1028.8.8.80x3057Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:37.462160110 CET192.168.1.1028.8.8.80x8c0aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:37.731558084 CET192.168.1.1028.8.8.80xafe5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:38.001010895 CET192.168.1.1028.8.8.80x9ad6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:38.255713940 CET192.168.1.1028.8.8.80xc4a9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:38.510190010 CET192.168.1.1028.8.8.80x3b19Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:38.794533014 CET192.168.1.1028.8.8.80xbdf0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:39.037404060 CET192.168.1.1028.8.8.80xfacStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:39.291409016 CET192.168.1.1028.8.8.80x85bbStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:39.541771889 CET192.168.1.1028.8.8.80xf4b8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:39.806390047 CET192.168.1.1028.8.8.80xd0ccStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:40.071918964 CET192.168.1.1028.8.8.80xaf1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:40.319116116 CET192.168.1.1028.8.8.80xcac4Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:40.565732956 CET192.168.1.1028.8.8.80x975fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:40.821423054 CET192.168.1.1028.8.8.80xbea9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:41.094196081 CET192.168.1.1028.8.8.80x429fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:41.347328901 CET192.168.1.1028.8.8.80xf3a5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:41.614700079 CET192.168.1.1028.8.8.80xea73Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:41.860361099 CET192.168.1.1028.8.8.80x117fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:42.106020927 CET192.168.1.1028.8.8.80x68b6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:42.351480007 CET192.168.1.1028.8.8.80x8beStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:42.598376036 CET192.168.1.1028.8.8.80xf047Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:42.837658882 CET192.168.1.1028.8.8.80x599dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:43.114191055 CET192.168.1.1028.8.8.80xc67aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:43.360255003 CET192.168.1.1028.8.8.80xdf72Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:43.608668089 CET192.168.1.1028.8.8.80x4bc8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:43.854275942 CET192.168.1.1028.8.8.80xa727Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:44.101288080 CET192.168.1.1028.8.8.80xdbf5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:44.347199917 CET192.168.1.1028.8.8.80xc1bcStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:44.588150024 CET192.168.1.1028.8.8.80x75a3Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:44.946187019 CET192.168.1.1028.8.8.80x3c18Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:45.183635950 CET192.168.1.1028.8.8.80x738cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:45.422210932 CET192.168.1.1028.8.8.80xcc8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:45.668564081 CET192.168.1.1028.8.8.80x47e2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:46.283267021 CET192.168.1.1028.8.8.80xcceaStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:47.013602972 CET192.168.1.1028.8.8.80x7e39Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:47.287213087 CET192.168.1.1028.8.8.80xc7a5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:47.583743095 CET192.168.1.1028.8.8.80xb440Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:47.867212057 CET192.168.1.1028.8.8.80x1812Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:48.120528936 CET192.168.1.1028.8.8.80xe52bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:48.375437975 CET192.168.1.1028.8.8.80xac49Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:48.629600048 CET192.168.1.1028.8.8.80x3d75Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:48.879422903 CET192.168.1.1028.8.8.80x86feStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:49.132314920 CET192.168.1.1028.8.8.80xa63cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:49.378151894 CET192.168.1.1028.8.8.80x5a32Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:49.626338959 CET192.168.1.1028.8.8.80xc988Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:49.879075050 CET192.168.1.1028.8.8.80xc670Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:50.131946087 CET192.168.1.1028.8.8.80x1060Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:50.377088070 CET192.168.1.1028.8.8.80xbed1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:50.643929005 CET192.168.1.1028.8.8.80x3909Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:50.914680004 CET192.168.1.1028.8.8.80x4002Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:51.172966003 CET192.168.1.1028.8.8.80x988bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:51.424407005 CET192.168.1.1028.8.8.80x747aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:51.688716888 CET192.168.1.1028.8.8.80x7842Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:51.925961971 CET192.168.1.1028.8.8.80xd8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:52.186191082 CET192.168.1.1028.8.8.80x317bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:52.426301003 CET192.168.1.1028.8.8.80x1a2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:52.672508001 CET192.168.1.1028.8.8.80xaa22Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:52.926002026 CET192.168.1.1028.8.8.80x457fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:53.175318003 CET192.168.1.1028.8.8.80x2606Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:53.464314938 CET192.168.1.1028.8.8.80xf903Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:53.706046104 CET192.168.1.1028.8.8.80xd822Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:53.961328030 CET192.168.1.1028.8.8.80xe415Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:54.243802071 CET192.168.1.1028.8.8.80xe95eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:54.499098063 CET192.168.1.1028.8.8.80xdc45Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:54.777808905 CET192.168.1.1028.8.8.80xde7dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:55.033621073 CET192.168.1.1028.8.8.80xbf40Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:55.324409008 CET192.168.1.1028.8.8.80xd828Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:55.567173958 CET192.168.1.1028.8.8.80x9f6aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:55.818265915 CET192.168.1.1028.8.8.80x543dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:56.062531948 CET192.168.1.1028.8.8.80x2531Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:56.301527977 CET192.168.1.1028.8.8.80x29d1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:56.595185041 CET192.168.1.1028.8.8.80xc211Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:56.899789095 CET192.168.1.1028.8.8.80x8ad5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:57.158828020 CET192.168.1.1028.8.8.80xc90eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:57.396714926 CET192.168.1.1028.8.8.80xcccbStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:57.649252892 CET192.168.1.1028.8.8.80x678Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:57.914612055 CET192.168.1.1028.8.8.80x154fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:58.198401928 CET192.168.1.1028.8.8.80x62c5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:58.474261045 CET192.168.1.1028.8.8.80x9be5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:58.724769115 CET192.168.1.1028.8.8.80x1186Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:58.974025965 CET192.168.1.1028.8.8.80x24c2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:59.221676111 CET192.168.1.1028.8.8.80xbc3eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:59.460984945 CET192.168.1.1028.8.8.80x592dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:58:59.717564106 CET192.168.1.1028.8.8.80x64e5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:00.027281046 CET192.168.1.1028.8.8.80x882Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:00.317502022 CET192.168.1.1028.8.8.80xbcb0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:00.571221113 CET192.168.1.1028.8.8.80xe7ddStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:00.818341970 CET192.168.1.1028.8.8.80x251bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:01.097857952 CET192.168.1.1028.8.8.80xef06Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:01.392920017 CET192.168.1.1028.8.8.80x5ec3Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:01.633388996 CET192.168.1.1028.8.8.80x8576Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:01.888259888 CET192.168.1.1028.8.8.80x3479Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:02.132716894 CET192.168.1.1028.8.8.80x47d0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:02.383390903 CET192.168.1.1028.8.8.80xef5fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:02.629148006 CET192.168.1.1028.8.8.80xce8dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:02.892231941 CET192.168.1.1028.8.8.80xec9cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:03.190824032 CET192.168.1.1028.8.8.80x9e20Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:03.471592903 CET192.168.1.1028.8.8.80xab58Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:03.724661112 CET192.168.1.1028.8.8.80x2371Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:03.971355915 CET192.168.1.1028.8.8.80xe93aStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:04.219145060 CET192.168.1.1028.8.8.80x15eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:04.520612955 CET192.168.1.1028.8.8.80x92b0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:04.759471893 CET192.168.1.1028.8.8.80xbefaStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:05.006222010 CET192.168.1.1028.8.8.80x2de0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:05.248702049 CET192.168.1.1028.8.8.80x170eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:05.498981953 CET192.168.1.1028.8.8.80xa682Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:05.741180897 CET192.168.1.1028.8.8.80xfc67Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:05.980118990 CET192.168.1.1028.8.8.80x11c9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:06.281059027 CET192.168.1.1028.8.8.80xdd5bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:06.544899940 CET192.168.1.1028.8.8.80x753dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:06.797962904 CET192.168.1.1028.8.8.80x6d65Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:07.054301023 CET192.168.1.1028.8.8.80x74afStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:07.338673115 CET192.168.1.1028.8.8.80x49e5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:07.599427938 CET192.168.1.1028.8.8.80x873Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:07.848397970 CET192.168.1.1028.8.8.80xca52Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:08.113929033 CET192.168.1.1028.8.8.80x2ea0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:08.353817940 CET192.168.1.1028.8.8.80xb473Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:08.590481997 CET192.168.1.1028.8.8.80xd9bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:08.840511084 CET192.168.1.1028.8.8.80x6837Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:09.117484093 CET192.168.1.1028.8.8.80xc3f1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:09.362986088 CET192.168.1.1028.8.8.80x8233Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:09.626601934 CET192.168.1.1028.8.8.80xfc74Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:09.909435034 CET192.168.1.1028.8.8.80x8cfcStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:10.157074928 CET192.168.1.1028.8.8.80x15ebStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:10.436167955 CET192.168.1.1028.8.8.80x5e50Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:10.713459015 CET192.168.1.1028.8.8.80xd411Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:10.969902992 CET192.168.1.1028.8.8.80x14ebStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:11.203850985 CET192.168.1.1028.8.8.80x8170Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:11.456494093 CET192.168.1.1028.8.8.80xe689Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:11.703495026 CET192.168.1.1028.8.8.80x5595Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:11.937109947 CET192.168.1.1028.8.8.80x276bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:12.215946913 CET192.168.1.1028.8.8.80x84eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:12.463819981 CET192.168.1.1028.8.8.80xabd1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:12.703722954 CET192.168.1.1028.8.8.80x6137Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:12.956382990 CET192.168.1.1028.8.8.80xc7b5Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:13.253719091 CET192.168.1.1028.8.8.80x565cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:13.534048080 CET192.168.1.1028.8.8.80xcf14Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:13.813366890 CET192.168.1.1028.8.8.80x3efaStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:14.054671049 CET192.168.1.1028.8.8.80x62bdStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:14.301342964 CET192.168.1.1028.8.8.80xcf67Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:14.550076008 CET192.168.1.1028.8.8.80x5c23Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:14.801049948 CET192.168.1.1028.8.8.80xa113Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:15.041461945 CET192.168.1.1028.8.8.80x22e9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:15.292025089 CET192.168.1.1028.8.8.80x5c1eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:15.566790104 CET192.168.1.1028.8.8.80x5f99Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:15.808876038 CET192.168.1.1028.8.8.80xe475Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:16.059195042 CET192.168.1.1028.8.8.80xf7eaStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:16.326210976 CET192.168.1.1028.8.8.80xb13Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:16.595269918 CET192.168.1.1028.8.8.80x16deStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:16.840065002 CET192.168.1.1028.8.8.80xd877Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:17.121419907 CET192.168.1.1028.8.8.80x34f6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:17.416896105 CET192.168.1.1028.8.8.80xd4b1Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:17.658880949 CET192.168.1.1028.8.8.80x14caStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:17.905126095 CET192.168.1.1028.8.8.80x8d2cStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:18.149868011 CET192.168.1.1028.8.8.80x716dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:18.387938976 CET192.168.1.1028.8.8.80x9e53Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:18.655294895 CET192.168.1.1028.8.8.80x6a2bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:18.912914038 CET192.168.1.1028.8.8.80xa6bcStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:19.161531925 CET192.168.1.1028.8.8.80x1612Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:19.434782982 CET192.168.1.1028.8.8.80xd050Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:19.705502033 CET192.168.1.1028.8.8.80xfa7bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:19.968070030 CET192.168.1.1028.8.8.80x324dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:20.268593073 CET192.168.1.1028.8.8.80x8f04Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:20.569405079 CET192.168.1.1028.8.8.80x6c90Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:20.806374073 CET192.168.1.1028.8.8.80xf958Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:21.048388004 CET192.168.1.1028.8.8.80x4ea8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:21.297161102 CET192.168.1.1028.8.8.80xea92Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:21.546818018 CET192.168.1.1028.8.8.80x591eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:21.814594030 CET192.168.1.1028.8.8.80x4c2dStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:22.097029924 CET192.168.1.1028.8.8.80x27e9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:22.349307060 CET192.168.1.1028.8.8.80xdcedStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:22.612602949 CET192.168.1.1028.8.8.80xde40Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:22.854568005 CET192.168.1.1028.8.8.80x16e9Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:23.133879900 CET192.168.1.1028.8.8.80x864eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:23.375050068 CET192.168.1.1028.8.8.80x84d2Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:23.630074978 CET192.168.1.1028.8.8.80x64e3Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:23.884705067 CET192.168.1.1028.8.8.80x52f3Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:24.130032063 CET192.168.1.1028.8.8.80x1e1fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:24.379892111 CET192.168.1.1028.8.8.80x39fdStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:24.622478962 CET192.168.1.1028.8.8.80xf5e8Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:24.888324022 CET192.168.1.1028.8.8.80x2a08Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:25.153604031 CET192.168.1.1028.8.8.80x66aeStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:25.405442953 CET192.168.1.1028.8.8.80x8e60Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:25.653238058 CET192.168.1.1028.8.8.80xb9aeStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:25.903892994 CET192.168.1.1028.8.8.80x3689Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:26.160885096 CET192.168.1.1028.8.8.80x5ee0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:26.416438103 CET192.168.1.1028.8.8.80xd3abStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:26.655599117 CET192.168.1.1028.8.8.80x1b62Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:26.904875040 CET192.168.1.1028.8.8.80x6ad7Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:27.140017033 CET192.168.1.1028.8.8.80xf9e6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:27.378006935 CET192.168.1.1028.8.8.80xd114Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:27.631149054 CET192.168.1.1028.8.8.80xd797Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:27.869113922 CET192.168.1.1028.8.8.80xedb3Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:28.103110075 CET192.168.1.1028.8.8.80x7fbfStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:28.354991913 CET192.168.1.1028.8.8.80x128eStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:28.619333029 CET192.168.1.1028.8.8.80x2126Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:28.852669954 CET192.168.1.1028.8.8.80xa0cdStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:29.107744932 CET192.168.1.1028.8.8.80xb6d6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:29.349948883 CET192.168.1.1028.8.8.80xe23bStandard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:29.604275942 CET192.168.1.1028.8.8.80x9bb0Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:29.926681042 CET192.168.1.1028.8.8.80x7a26Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:30.187779903 CET192.168.1.1028.8.8.80xa5a6Standard query (0)pownedfag.pwA (IP address)IN (0x0001)
Oct 31, 2020 22:59:30.439661980 CET192.168.1.1028.8.8.80xf33fStandard query (0)pownedfag.pwA (IP address)IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Start time:22:57:30
Start date:31/10/2020
Path:C:\Users\user\Desktop\9fERLFJPjq.exe
Wow64 process (32bit):true
Commandline:'C:\Users\user\Desktop\9fERLFJPjq.exe'
Imagebase:0x400000
File size:1593344 bytes
MD5 hash:DDD60E9AE362DEF377AA70D414ED374D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:Visual Basic
Yara matches:
  • Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
  • Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: Florian Roth
  • Rule: LokiBot_Dropper_Packed_R11_Feb18_RID328F, Description: Semiautomatic generated rule - file scan copy.pdf.r11, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: Florian Roth
  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: Joe Security
  • Rule: JoeSecurity_DarkCometRat, Description: Yara detected DarkComet, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
  • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: Joe Security
  • Rule: DarkComet_1, Description: DarkComet RAT, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: botherder https://github.com/botherder
  • Rule: DarkComet_3, Description: unknown, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
  • Rule: DarkComet_4, Description: unknown, Source: 00000002.00000002.605724298.0000000002F24000.00000040.00000001.sdmp, Author: unknown
Reputation:low

General

Start time:22:58:03
Start date:31/10/2020
Path:C:\Users\user\Desktop\9fERLFJPjq.exe
Wow64 process (32bit):true
Commandline:'C:\Users\user\Desktop\9fERLFJPjq.exe'
Imagebase:0x400000
File size:1593344 bytes
MD5 hash:DDD60E9AE362DEF377AA70D414ED374D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:Borland Delphi
Yara matches:
  • Rule: DarkComet_2, Description: DarkComet, Source: 00000006.00000002.602074619.00000000006C1000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
  • Rule: DarkComet_2, Description: DarkComet, Source: 00000006.00000002.602017158.0000000000696000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
  • Rule: DarkComet_2, Description: DarkComet, Source: 00000006.00000002.601989587.0000000000668000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
  • Rule: DarkComet_2, Description: DarkComet, Source: 00000006.00000002.602066507.00000000006BA000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
Reputation:low

General

Start time:22:58:12
Start date:31/10/2020
Path:C:\Windows\System32\wscript.exe
Wow64 process (32bit):false
Commandline:'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enxavse.vbs'
Imagebase:0x7ff7bd3a0000
File size:163840 bytes
MD5 hash:9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:false
Has administrator privileges:false
Programmed in:C, C++ or other language
Reputation:high

General

Start time:22:58:14
Start date:31/10/2020
Path:C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe
Wow64 process (32bit):true
Commandline:'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe'
Imagebase:0x400000
File size:1593344 bytes
MD5 hash:D409D2D823F91A2DCC7EE6563B632BF3
Has elevated privileges:false
Has administrator privileges:false
Programmed in:Visual Basic
Yara matches:
  • Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: Florian Roth
  • Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
  • Rule: Malware_QA_update_RID2DAD, Description: VT Research QA uploaded malware - file update.exe, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: Florian Roth
  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: Joe Security
  • Rule: JoeSecurity_DarkCometRat, Description: Yara detected DarkComet, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
  • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: Joe Security
  • Rule: DarkComet_1, Description: DarkComet RAT, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: botherder https://github.com/botherder
  • Rule: DarkComet_3, Description: unknown, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
  • Rule: DarkComet_4, Description: unknown, Source: 00000008.00000002.501960152.0000000002FB6000.00000040.00000001.sdmp, Author: unknown
Antivirus matches:
  • Detection: 100%, Avira
  • Detection: 100%, Joe Sandbox ML
  • Detection: 73%, Virustotal, Browse
  • Detection: 66%, ReversingLabs
Reputation:low

General

Start time:22:58:49
Start date:31/10/2020
Path:C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe
Wow64 process (32bit):true
Commandline:'C:\Users\user\AppData\Local\Temp\Exjoares\enxavse.exe'
Imagebase:0x400000
File size:1593344 bytes
MD5 hash:D409D2D823F91A2DCC7EE6563B632BF3
Has elevated privileges:false
Has administrator privileges:false
Programmed in:Borland Delphi
Yara matches:
  • Rule: DarkComet_2, Description: DarkComet, Source: 0000000B.00000002.503082454.0000000000668000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
  • Rule: DarkComet_2, Description: DarkComet, Source: 0000000B.00000002.503148674.00000000006C1000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
  • Rule: DarkComet_2, Description: DarkComet, Source: 0000000B.00000002.503141508.00000000006BA000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
  • Rule: DarkComet_2, Description: DarkComet, Source: 0000000B.00000002.503100449.0000000000696000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
Reputation:low

Disassembly

Reset < >