Edit tour
Windows
Analysis Report
XlKQ797V2E.exe
Overview
General Information
| Sample name: | XlKQ797V2E.exerenamed because original name is a hash value |
| Original sample name: | 8d1d2122c8a31716baf394bb1e4c6f28.exe |
| Analysis ID: | 1543056 |
| MD5: | 8d1d2122c8a31716baf394bb1e4c6f28 |
| SHA1: | b5eea46ea189e9c7b7172c5cca7b543eca377b48 |
| SHA256: | b122cc9290f58d4429c0e2bf1870777520493b95adf132a8a784d0dfa8495cf7 |
| Tags: | 32exe |
| Infos: | |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Connects to many different domains
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
XlKQ797V2E.exe (PID: 6708 cmdline: "C:\Users\ user\Deskt op\XlKQ797 V2E.exe" MD5: 8D1D2122C8A31716BAF394BB1E4C6F28) 
taskkill.exe (PID: 6724 cmdline: taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 6744 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7008 cmdline:
taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7084 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 1704 cmdline:
taskkill / F /IM msed ge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 928 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 1368 cmdline:
taskkill / F /IM oper a.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 5496 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 4228 cmdline:
taskkill / F /IM brav e.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 1344 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
firefox.exe (PID: 1228 cmdline: "C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" --k iosk "http s://youtub e.com/acco unt?=https ://account s.google.c om/v3/sign in/challen ge/pwd" -- no-default -browser-c heck --dis able-popup -blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
- firefox.exe (PID: 7136 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" --k iosk https ://youtube .com/accou nt?=https: //accounts .google.co m/v3/signi n/challeng e/pwd --no -default-b rowser-che ck --disab le-popup-b locking -- attempting -deelevati on MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 6784 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" --k iosk https ://youtube .com/accou nt?=https: //accounts .google.co m/v3/signi n/challeng e/pwd --no -default-b rowser-che ck --disab le-popup-b locking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 5984 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" -co ntentproc --channel= 2312 -pare ntBuildID 2023092723 2528 -pref sHandle 22 56 -prefMa pHandle 22 48 -prefsL en 25359 - prefMapSiz e 237879 - win32kLock edDown -ap pDir "C:\P rogram Fil es\Mozilla Firefox\b rowser" - {ad9adf17- 56b2-4622- b491-11a7d 2cd79cf} 6 784 "\\.\p ipe\gecko- crash-serv er-pipe.67 84" 215611 70d10 sock et MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 7272 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" -co ntentproc --channel= 4052 -pare ntBuildID 2023092723 2528 -pref sHandle 40 64 -prefMa pHandle 40 60 -prefsL en 26208 - prefMapSiz e 237879 - appDir "C: \Program F iles\Mozil la Firefox \browser" - {bec8f86 2-863b-4d2 7-96b4-2cc 2a1669711} 6784 "\\. \pipe\geck o-crash-se rver-pipe. 6784" 2156 1142f10 rd d MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 5024 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" -co ntentproc --channel= 5148 -pare ntBuildID 2023092723 2528 -sand boxingKind 0 -prefsH andle 5380 -prefMapH andle 1548 -prefsLen 33185 -pr efMapSize 237879 -wi n32kLocked Down -appD ir "C:\Pro gram Files \Mozilla F irefox\bro wser" - {d f6a430d-a2 ca-4a6c-a2 af-9981d1b 358b2} 678 4 "\\.\pip e\gecko-cr ash-server -pipe.6784 " 21572a49 910 utilit y MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_007ADBBE | |
| Source: | Code function: | 0_2_007B68EE | |
| Source: | Code function: | 0_2_007B698F | |
| Source: | Code function: | 0_2_007AD076 | |
| Source: | Code function: | 0_2_007AD3A9 | |
| Source: | Code function: | 0_2_007B9642 | |
| Source: | Code function: | 0_2_007B979D | |
| Source: | Code function: | 0_2_007B9B2B | |
| Source: | Code function: | 0_2_007B5C97 | |
| Source: | Memory has grown: | ||
| Source: | Network traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_007BCE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_007BEAFF | |
| Source: | Code function: | 0_2_007BED6A | |
| Source: | Code function: | 0_2_007BEAFF | |
| Source: | Code function: | 0_2_007AAA57 | |
| Source: | Code function: | 0_2_007D9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_8d960f75-a | |
| Source: | String found in binary or memory: | memstr_60a9a045-a | |
| Source: | String found in binary or memory: | memstr_0a7c8559-9 | |
| Source: | String found in binary or memory: | memstr_195f3c11-9 | |
| Source: | Code function: | 16_2_000001DFBD0CACF7 | |
| Source: | Code function: | 16_2_000001DFBD0E41B2 | |
| Source: | Code function: | 0_2_007AD5EB | |
| Source: | Code function: | 0_2_007A1201 | |
| Source: | Code function: | 0_2_007AE8F6 | |
| Source: | Code function: | 0_2_00748060 | |
| Source: | Code function: | 0_2_007B2046 | |
| Source: | Code function: | 0_2_007A8298 | |
| Source: | Code function: | 0_2_0077E4FF | |
| Source: | Code function: | 0_2_0077676B | |
| Source: | Code function: | 0_2_007D4873 | |
| Source: | Code function: | 0_2_0074CAF0 | |
| Source: | Code function: | 0_2_0076CAA0 | |
| Source: | Code function: | 0_2_0075CC39 | |
| Source: | Code function: | 0_2_00776DD9 | |
| Source: | Code function: | 0_2_0075B119 | |
| Source: | Code function: | 0_2_007491C0 | |
| Source: | Code function: | 0_2_00761394 | |
| Source: | Code function: | 0_2_00761706 | |
| Source: | Code function: | 0_2_0076781B | |
| Source: | Code function: | 0_2_0075997D | |
| Source: | Code function: | 0_2_00747920 | |
| Source: | Code function: | 0_2_007619B0 | |
| Source: | Code function: | 0_2_00767A4A | |
| Source: | Code function: | 0_2_00761C77 | |
| Source: | Code function: | 0_2_00767CA7 | |
| Source: | Code function: | 0_2_007CBE44 | |
| Source: | Code function: | 0_2_00779EEE | |
| Source: | Code function: | 0_2_00761F32 | |
| Source: | Code function: | 16_2_000001DFBD0CACF7 | |
| Source: | Code function: | 16_2_000001DFBD0E41B2 | |
| Source: | Code function: | 16_2_000001DFBD0E48DC | |
| Source: | Code function: | 16_2_000001DFBD0E41F2 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_007B37B5 | |
| Source: | Code function: | 0_2_007A10BF | |
| Source: | Code function: | 0_2_007A16C3 | |
| Source: | Code function: | 0_2_007B51CD | |
| Source: | Code function: | 0_2_007AD4DC | |
| Source: | Code function: | 0_2_007B648E | |
| Source: | Code function: | 0_2_007442A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_007442DE | |
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00760A89 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | Code function: | 0_2_0075F98E | |
| Source: | Code function: | 0_2_007D1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-95821 | ||
| Source: | Code function: | 16_2_000001DFBD0CACF7 | |
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_007ADBBE | |
| Source: | Code function: | 0_2_007B68EE | |
| Source: | Code function: | 0_2_007B698F | |
| Source: | Code function: | 0_2_007AD076 | |
| Source: | Code function: | 0_2_007AD3A9 | |
| Source: | Code function: | 0_2_007B9642 | |
| Source: | Code function: | 0_2_007B979D | |
| Source: | Code function: | 0_2_007B9B2B | |
| Source: | Code function: | 0_2_007B5C97 | |
| Source: | Code function: | 0_2_007442DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 16_2_000001DFBD0CACF7 | |
| Source: | Code function: | 0_2_007BEAA2 | |
| Source: | Code function: | 0_2_00772622 | |
| Source: | Code function: | 0_2_007442DE | |
| Source: | Code function: | 0_2_00764CE8 | |
| Source: | Code function: | 0_2_007A0B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00772622 | |
| Source: | Code function: | 0_2_0076083F | |
| Source: | Code function: | 0_2_007609D5 | |
| Source: | Code function: | 0_2_00760C21 | |
| Source: | Code function: | 0_2_007A1201 | |
| Source: | Code function: | 0_2_00782BA5 | |
| Source: | Code function: | 0_2_007AB226 | |
| Source: | Code function: | 0_2_007C22DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_007A0B62 | |
| Source: | Code function: | 0_2_007A1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00760698 | |
| Source: | Code function: | 0_2_007B8195 | |
| Source: | Code function: | 0_2_0079D27A | |
| Source: | Code function: | 0_2_0077BB6F | |
| Source: | Code function: | 0_2_007442DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_007C1204 | |
| Source: | Code function: | 0_2_007C1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 12 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 Extra Window Memory Injection | 2 Obfuscated Files or Information | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 2 Valid Accounts | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 3 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 21 Access Token Manipulation | 1 Extra Window Memory Injection | LSA Secrets | 131 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 2 Process Injection | 1 Masquerading | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 2 Valid Accounts | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 Virtualization/Sandbox Evasion | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 21 Access Token Manipulation | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
| IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | 2 Process Injection | Network Sniffing | Network Service Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 41% | Virustotal | Browse | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | ReversingLabs |
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| example.org | 93.184.215.14 | true | false |
| unknown |
| star-mini.c10r.facebook.com | 157.240.251.35 | true | false |
| unknown |
| prod.classify-client.prod.webservices.mozgcp.net | 35.190.72.216 | true | false |
| unknown |
| prod.balrog.prod.cloudops.mozgcp.net | 35.244.181.201 | true | false |
| unknown |
| twitter.com | 104.244.42.1 | true | false | unknown | |
| prod.detectportal.prod.cloudops.mozgcp.net | 34.107.221.82 | true | false | unknown | |
| services.addons.mozilla.org | 151.101.65.91 | true | false | unknown | |
| dyna.wikimedia.org | 185.15.59.224 | true | false | unknown | |
| prod.remote-settings.prod.webservices.mozgcp.net | 34.149.100.209 | true | false | unknown | |
| contile.services.mozilla.com | 34.117.188.166 | true | false | unknown | |
| youtube.com | 142.250.185.174 | true | false | unknown | |
| prod.content-signature-chains.prod.webservices.mozgcp.net | 34.160.144.191 | true | false | unknown | |
| youtube-ui.l.google.com | 142.250.186.78 | true | false | unknown | |
| us-west1.prod.sumo.prod.webservices.mozgcp.net | 34.149.128.2 | true | false | unknown | |
| reddit.map.fastly.net | 151.101.1.140 | true | false | unknown | |
| ipv4only.arpa | 192.0.0.171 | true | false | unknown | |
| prod.ads.prod.webservices.mozgcp.net | 34.117.188.166 | true | false | unknown | |
| push.services.mozilla.com | 34.107.243.93 | true | false | unknown | |
| normandy-cdn.services.mozilla.com | 35.201.103.21 | true | false | unknown | |
| telemetry-incoming.r53-2.services.mozilla.com | 34.120.208.123 | true | false | unknown | |
| www.reddit.com | unknown | unknown | false | unknown | |
| spocs.getpocket.com | unknown | unknown | false | unknown | |
| content-signature-2.cdn.mozilla.net | unknown | unknown | false | unknown | |
| support.mozilla.org | unknown | unknown | false | unknown | |
| firefox.settings.services.mozilla.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown | |
| www.facebook.com | unknown | unknown | false | unknown | |
| detectportal.firefox.com | unknown | unknown | false | unknown | |
| normandy.cdn.mozilla.net | unknown | unknown | false | unknown | |
| shavar.services.mozilla.com | unknown | unknown | false | unknown | |
| www.wikipedia.org | unknown | unknown | false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 34.149.100.209 | prod.remote-settings.prod.webservices.mozgcp.net | United States | 2686 | ATGS-MMD-ASUS | false | |
| 34.107.243.93 | push.services.mozilla.com | United States | 15169 | GOOGLEUS | false | |
| 151.101.65.91 | services.addons.mozilla.org | United States | 54113 | FASTLYUS | false | |
| 34.107.221.82 | prod.detectportal.prod.cloudops.mozgcp.net | United States | 15169 | GOOGLEUS | false | |
| 35.244.181.201 | prod.balrog.prod.cloudops.mozgcp.net | United States | 15169 | GOOGLEUS | false | |
| 34.117.188.166 | contile.services.mozilla.com | United States | 139070 | GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | false | |
| 142.250.185.174 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 35.201.103.21 | normandy-cdn.services.mozilla.com | United States | 15169 | GOOGLEUS | false | |
| 35.190.72.216 | prod.classify-client.prod.webservices.mozgcp.net | United States | 15169 | GOOGLEUS | false | |
| 34.160.144.191 | prod.content-signature-chains.prod.webservices.mozgcp.net | United States | 2686 | ATGS-MMD-ASUS | false | |
| 34.120.208.123 | telemetry-incoming.r53-2.services.mozilla.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 127.0.0.1 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1543056 |
| Start date and time: | 2024-10-27 07:27:11 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 16s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 22 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | XlKQ797V2E.exerenamed because original name is a hash value |
| Original Sample Name: | 8d1d2122c8a31716baf394bb1e4c6f28.exe |
| Detection: | MAL |
| Classification: | mal64.evad.winEXE@34/36@68/12 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 184.28.90.27, 35.155.254.84, 52.32.18.233, 44.238.230.7, 142.250.184.238, 2.22.61.72, 2.22.61.59, 142.250.185.74, 216.58.212.138, 142.250.184.206
- Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, a17.rackcdn.com.mdc.edgesuite.net, detectportal.prod.mozaws.net, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, e16604.g.akamaiedge.net, safebrowsing.googleapis.com, prod.fs.microsoft.com.akadns.net, location.services.mozilla.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtCreateFile calls found.
- Report size getting too big, too many NtOpenFile calls found.
| Time | Type | Description |
|---|---|---|
| 02:28:27 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 34.117.188.166 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| 34.149.100.209 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| 34.160.144.191 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| 151.101.65.91 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| services.addons.mozilla.org | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| example.org | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| twitter.com | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| star-mini.c10r.facebook.com | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| ATGS-MMD-ASUS | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| FASTLYUS | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| ATGS-MMD-ASUS | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| fb0aa01abe9d8e4037eb3473ca6e2dca | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy) | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse |
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_a2cb3021-4c44-4599-b3f6-edbaec57071f.json (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 7813 |
| Entropy (8bit): | 5.17985305181683 |
| Encrypted: | false |
| SSDEEP: | 192:6FjMXFxScbhbVbTbfbRbObtbyEl7n0riJA6WnSrDtTUd/SkDr/:6FYacNhnzFSJUrRBnSrDhUd/B |
| MD5: | D24399D29EDA4F630012D9D4013484D2 |
| SHA1: | 587A4EC5C04B0D2B95C7DE68153D89CACF3835FB |
| SHA-256: | 7AA6C1670B6AED81CB9E2D40B21EC46A1F00C5E5458A00D660A2DF07DC90F755 |
| SHA-512: | 18563E1FA925AEFA372DD36EFEEF8CE4DFC7DEA3C6D3B8106EFE33E2FAC33D1229F632AB2D0138BAB2EB32C161B9BB9926E312BCBAFA9C67E64701098F633D82 |
| Malicious: | false |
| Preview: |
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_a2cb3021-4c44-4599-b3f6-edbaec57071f.json.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 7813 |
| Entropy (8bit): | 5.17985305181683 |
| Encrypted: | false |
| SSDEEP: | 192:6FjMXFxScbhbVbTbfbRbObtbyEl7n0riJA6WnSrDtTUd/SkDr/:6FYacNhnzFSJUrRBnSrDhUd/B |
| MD5: | D24399D29EDA4F630012D9D4013484D2 |
| SHA1: | 587A4EC5C04B0D2B95C7DE68153D89CACF3835FB |
| SHA-256: | 7AA6C1670B6AED81CB9E2D40B21EC46A1F00C5E5458A00D660A2DF07DC90F755 |
| SHA-512: | 18563E1FA925AEFA372DD36EFEEF8CE4DFC7DEA3C6D3B8106EFE33E2FAC33D1229F632AB2D0138BAB2EB32C161B9BB9926E312BCBAFA9C67E64701098F633D82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 0.4593089050301797 |
| Encrypted: | false |
| SSDEEP: | 48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L |
| MD5: | D910AD167F0217587501FDCDB33CC544 |
| SHA1: | 2F57441CEFDC781011B53C1C5D29AC54835AFC1D |
| SHA-256: | E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81 |
| SHA-512: | F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 453023 |
| Entropy (8bit): | 7.997718157581587 |
| Encrypted: | true |
| SSDEEP: | 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3 |
| MD5: | 85430BAED3398695717B0263807CF97C |
| SHA1: | FFFBEE923CEA216F50FCE5D54219A188A5100F41 |
| SHA-256: | A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E |
| SHA-512: | 06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3621 |
| Entropy (8bit): | 4.926080261991058 |
| Encrypted: | false |
| SSDEEP: | 96:8S+OfJQPUFpOdwNIOdYVjvYcXaNLKmZ8P:8S+OBIUjOdwiOdYVjjwLKi8P |
| MD5: | 624C6554845237BB07C02717CF1D4C4E |
| SHA1: | 511B0056FE9F50F304079FF993B24393AC64080F |
| SHA-256: | E9A296965435D5F193BE8C880D3EE9A7176FA1D21D5881FEEE5F35CEE6AFF4AA |
| SHA-512: | 952244FE39CAC52BB8511DCD089C62F3A305B0FD89CB1869D5CCCC0C20300C0342F6B7D47E8B8764484853275AED078A91064AC974AEB66F4F2D5ECF6C616BC3 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3621 |
| Entropy (8bit): | 4.926080261991058 |
| Encrypted: | false |
| SSDEEP: | 96:8S+OfJQPUFpOdwNIOdYVjvYcXaNLKmZ8P:8S+OBIUjOdwiOdYVjjwLKi8P |
| MD5: | 624C6554845237BB07C02717CF1D4C4E |
| SHA1: | 511B0056FE9F50F304079FF993B24393AC64080F |
| SHA-256: | E9A296965435D5F193BE8C880D3EE9A7176FA1D21D5881FEEE5F35CEE6AFF4AA |
| SHA-512: | 952244FE39CAC52BB8511DCD089C62F3A305B0FD89CB1869D5CCCC0C20300C0342F6B7D47E8B8764484853275AED078A91064AC974AEB66F4F2D5ECF6C616BC3 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5312 |
| Entropy (8bit): | 6.615424734763731 |
| Encrypted: | false |
| SSDEEP: | 96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws |
| MD5: | 1B9C8056D3619CE5A8C59B0C09873F17 |
| SHA1: | 1015C630E1937AA63F6AB31743782ECB5D78CCD8 |
| SHA-256: | A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3 |
| SHA-512: | B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5312 |
| Entropy (8bit): | 6.615424734763731 |
| Encrypted: | false |
| SSDEEP: | 96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws |
| MD5: | 1B9C8056D3619CE5A8C59B0C09873F17 |
| SHA1: | 1015C630E1937AA63F6AB31743782ECB5D78CCD8 |
| SHA-256: | A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3 |
| SHA-512: | B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 24 |
| Entropy (8bit): | 3.91829583405449 |
| Encrypted: | false |
| SSDEEP: | 3:YWGifTJE6iHQ:YWGif9EE |
| MD5: | 3088F0272D29FAA42ED452C5E8120B08 |
| SHA1: | C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23 |
| SHA-256: | D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06 |
| SHA-512: | B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 24 |
| Entropy (8bit): | 3.91829583405449 |
| Encrypted: | false |
| SSDEEP: | 3:YWGifTJE6iHQ:YWGif9EE |
| MD5: | 3088F0272D29FAA42ED452C5E8120B08 |
| SHA1: | C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23 |
| SHA-256: | D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06 |
| SHA-512: | B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 262144 |
| Entropy (8bit): | 0.04905391753567332 |
| Encrypted: | false |
| SSDEEP: | 24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5 |
| MD5: | DD9D28E87ED57D16E65B14501B4E54D1 |
| SHA1: | 793839B47326441BE2D1336BA9A61C9B948C578D |
| SHA-256: | BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC |
| SHA-512: | A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66 |
| Entropy (8bit): | 4.837595020998689 |
| Encrypted: | false |
| SSDEEP: | 3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt |
| MD5: | A6338865EB252D0EF8FCF11FA9AF3F0D |
| SHA1: | CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3 |
| SHA-256: | 078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965 |
| SHA-512: | D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66 |
| Entropy (8bit): | 4.837595020998689 |
| Encrypted: | false |
| SSDEEP: | 3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt |
| MD5: | A6338865EB252D0EF8FCF11FA9AF3F0D |
| SHA1: | CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3 |
| SHA-256: | 078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965 |
| SHA-512: | D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 36830 |
| Entropy (8bit): | 5.185924656884556 |
| Encrypted: | false |
| SSDEEP: | 768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk |
| MD5: | 5656BA69BD2966108A461AAE35F60226 |
| SHA1: | 9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C |
| SHA-256: | 587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299 |
| SHA-512: | 38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 36830 |
| Entropy (8bit): | 5.185924656884556 |
| Encrypted: | false |
| SSDEEP: | 768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk |
| MD5: | 5656BA69BD2966108A461AAE35F60226 |
| SHA1: | 9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C |
| SHA-256: | 587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299 |
| SHA-512: | 38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 0.017262956703125623 |
| Encrypted: | false |
| SSDEEP: | 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX |
| MD5: | B7C14EC6110FA820CA6B65F5AEC85911 |
| SHA1: | 608EEB7488042453C9CA40F7E1398FC1A270F3F4 |
| SHA-256: | FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB |
| SHA-512: | D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy) 
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1021904 |
| Entropy (8bit): | 6.648417932394748 |
| Encrypted: | false |
| SSDEEP: | 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x |
| MD5: | FE3355639648C417E8307C6D051E3E37 |
| SHA1: | F54602D4B4778DA21BC97C7238FC66AA68C8EE34 |
| SHA-256: | 1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E |
| SHA-512: | 8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1021904 |
| Entropy (8bit): | 6.648417932394748 |
| Encrypted: | false |
| SSDEEP: | 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x |
| MD5: | FE3355639648C417E8307C6D051E3E37 |
| SHA1: | F54602D4B4778DA21BC97C7238FC66AA68C8EE34 |
| SHA-256: | 1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E |
| SHA-512: | 8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 116 |
| Entropy (8bit): | 4.968220104601006 |
| Encrypted: | false |
| SSDEEP: | 3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn |
| MD5: | 3D33CDC0B3D281E67DD52E14435DD04F |
| SHA1: | 4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB |
| SHA-256: | F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B |
| SHA-512: | A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 116 |
| Entropy (8bit): | 4.968220104601006 |
| Encrypted: | false |
| SSDEEP: | 3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn |
| MD5: | 3D33CDC0B3D281E67DD52E14435DD04F |
| SHA1: | 4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB |
| SHA-256: | F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B |
| SHA-512: | A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 98304 |
| Entropy (8bit): | 0.07330954253084 |
| Encrypted: | false |
| SSDEEP: | 12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zkiIo:DLhesh7Owd4+ji |
| MD5: | 5DDBC9EB7597AE9BE27DF76E9ED425C3 |
| SHA1: | 839522C03859FD05AEB812117C36EBDC5E0119A5 |
| SHA-256: | 7BC1903DFC27744BC63C9F2A6FE214316008173FFECB1D4272111F1586A32585 |
| SHA-512: | BE650747988853EF7F4E365C30F45D4B20A21BCBC3302CD53DC9A3949896FA720195667B030E189FFF03DA990268055CA9A7C78B3915AAB17041ADAE4EBD829A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 0.035699946889726504 |
| Encrypted: | false |
| SSDEEP: | 3:GtlstFlgOLHVol1lstFlgOLHN/x89//alEl:GtWtDL14WtDLt/x89XuM |
| MD5: | 9BDAF441DD37F392E2A3FECB7469734E |
| SHA1: | 1166A511E4CBCDFD91A8B40437C6D7A0338607A8 |
| SHA-256: | 42D314ECED6C0BA0F5250B0E174D52D5C04E75B4DCD591501A7FCF0A16548B2F |
| SHA-512: | 6D4A6252DACA3F7D85C5FB977D93C3FCC3298519129372D81A36E540B303A2262B5444ECDFCD000D0C7ADB42C9DC744DE945B5AA05738CE38566109D152AF13C |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32824 |
| Entropy (8bit): | 0.03963053308770313 |
| Encrypted: | false |
| SSDEEP: | 3:Ol1KVjmonygZmDgnVStll8rEXsxdwhml8XW3R2:KWfnVRVGll8dMhm93w |
| MD5: | 3A07527F9B5DF16C300E9C69E7AA8B45 |
| SHA1: | 0D8791E526159CF21FF523076A9A99D51EA9DAC4 |
| SHA-256: | C9629DC601164D1A46F49B6D17C618602AECF788CF0DDEBC7A1BA59E463018F4 |
| SHA-512: | 56F18E8CE5ABB86D632DDA97164C84FBEA3AD0D536CB35778F68BB62DFE9AC677E3FAF726BF2277608EA90372381C08D82F9AC71DE156341BBC1C469959654C6 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13254 |
| Entropy (8bit): | 5.4937056406823075 |
| Encrypted: | false |
| SSDEEP: | 192:snaRtLYbBp6phj4qyaaXv6K153+Ni95RfGNBw8dNSl:Be3qJoqmcwK0 |
| MD5: | 8EA8240D5B8C3DB4B29CB90603BC722D |
| SHA1: | D6B9C44737E6575632107D2C6638D2BEC667F674 |
| SHA-256: | 5DE3D9F1706F2BB4338A6E175A67C3816FF98BDCC4C6E90F21F9C335E51FE555 |
| SHA-512: | EDE38EA44A6EEC4A6F8EA39B1D85AAA12129207D9AE9AC91C81B2DC18657526A6272B89D4D2F833EEE79B67E7ECBF8B6B86DE2C1CB3834378748C4CEB34C98A3 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13254 |
| Entropy (8bit): | 5.4937056406823075 |
| Encrypted: | false |
| SSDEEP: | 192:snaRtLYbBp6phj4qyaaXv6K153+Ni95RfGNBw8dNSl:Be3qJoqmcwK0 |
| MD5: | 8EA8240D5B8C3DB4B29CB90603BC722D |
| SHA1: | D6B9C44737E6575632107D2C6638D2BEC667F674 |
| SHA-256: | 5DE3D9F1706F2BB4338A6E175A67C3816FF98BDCC4C6E90F21F9C335E51FE555 |
| SHA-512: | EDE38EA44A6EEC4A6F8EA39B1D85AAA12129207D9AE9AC91C81B2DC18657526A6272B89D4D2F833EEE79B67E7ECBF8B6B86DE2C1CB3834378748C4CEB34C98A3 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 65536 |
| Entropy (8bit): | 0.04062825861060003 |
| Encrypted: | false |
| SSDEEP: | 6:ltBl/l4/WN1h4BEJYqWvLue3FMOrMZ0l:DBl/WuntfJiFxMZO |
| MD5: | 18F65713B07CB441E6A98655B726D098 |
| SHA1: | 2CEFA32BC26B25BE81C411B60C9925CB0F1F8F88 |
| SHA-256: | B6C268E48546B113551A5AF9CA86BB6A462A512DE6C9289315E125CEB0FD8621 |
| SHA-512: | A6871076C7D7ED53B630F9F144ED04303AD54A2E60B94ECA2AA96964D1AB375EEFDCA86CE0D3EB0E9DBB81470C6BD159877125A080C95EB17E54A52427F805FB |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\1a3c9922-cf8e-4b1c-9637-d3e0e44b2c1f (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 493 |
| Entropy (8bit): | 4.953164016686978 |
| Encrypted: | false |
| SSDEEP: | 12:YZFg8xRZJNWIVHlW8cOlZGV1AQIYzvZcyBuLZ2d:Y9hNWSlCOlZGV1AQIWZcy6Z2d |
| MD5: | 6F0DF6D5CF9BE401006BF329809741E6 |
| SHA1: | 00D883C4C1FE12F9F91BBB7214F61924C8352B39 |
| SHA-256: | E146FD2D7364264D0AE0026903CC24F7E6606B4F6BD53D2753CA2182B475F0DF |
| SHA-512: | B2059BA6E2F631F5E8BDE85286F17B9AFD4E5AFD36A4C8E251AF3FEFE572E9FD13A1280F33639375E83C565377646E0E1BCE2F0F229639DBD67BC33B345FBE64 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\1a3c9922-cf8e-4b1c-9637-d3e0e44b2c1f.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 493 |
| Entropy (8bit): | 4.953164016686978 |
| Encrypted: | false |
| SSDEEP: | 12:YZFg8xRZJNWIVHlW8cOlZGV1AQIYzvZcyBuLZ2d:Y9hNWSlCOlZGV1AQIWZcy6Z2d |
| MD5: | 6F0DF6D5CF9BE401006BF329809741E6 |
| SHA1: | 00D883C4C1FE12F9F91BBB7214F61924C8352B39 |
| SHA-256: | E146FD2D7364264D0AE0026903CC24F7E6606B4F6BD53D2753CA2182B475F0DF |
| SHA-512: | B2059BA6E2F631F5E8BDE85286F17B9AFD4E5AFD36A4C8E251AF3FEFE572E9FD13A1280F33639375E83C565377646E0E1BCE2F0F229639DBD67BC33B345FBE64 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 90 |
| Entropy (8bit): | 4.194538242412464 |
| Encrypted: | false |
| SSDEEP: | 3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr |
| MD5: | C4AB2EE59CA41B6D6A6EA911F35BDC00 |
| SHA1: | 5942CD6505FC8A9DABA403B082067E1CDEFDFBC4 |
| SHA-256: | 00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2 |
| SHA-512: | 71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 90 |
| Entropy (8bit): | 4.194538242412464 |
| Encrypted: | false |
| SSDEEP: | 3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr |
| MD5: | C4AB2EE59CA41B6D6A6EA911F35BDC00 |
| SHA1: | 5942CD6505FC8A9DABA403B082067E1CDEFDFBC4 |
| SHA-256: | 00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2 |
| SHA-512: | 71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1568 |
| Entropy (8bit): | 6.335261083146529 |
| Encrypted: | false |
| SSDEEP: | 24:v+USUGlcAxSwwRLXnIgjf/pnxQwRlszT5sKt0er3eHVQj6TL2amhujJlOsIomNVn:GUpOxAbZnR6Tr3eHTa4JlIUNR4 |
| MD5: | 1A85F7DA80A862190436B47327A99A46 |
| SHA1: | 77F12AF6A42A146A03E30613B7EBEB8ACFE9B986 |
| SHA-256: | D4DD9A32658FB6DEE174A190F5DCCA9A971A7EF65267225AC23413221D38442E |
| SHA-512: | CD8687FA5C61F2A8F190860348567010F9D46360957DA0A82ECEDC97E33AE80BA3EC0C33F23E1C7DAF410CFEE8AEF14D12C5BDEC3AEB1DE6712CCE4AF0044074 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1568 |
| Entropy (8bit): | 6.335261083146529 |
| Encrypted: | false |
| SSDEEP: | 24:v+USUGlcAxSwwRLXnIgjf/pnxQwRlszT5sKt0er3eHVQj6TL2amhujJlOsIomNVn:GUpOxAbZnR6Tr3eHTa4JlIUNR4 |
| MD5: | 1A85F7DA80A862190436B47327A99A46 |
| SHA1: | 77F12AF6A42A146A03E30613B7EBEB8ACFE9B986 |
| SHA-256: | D4DD9A32658FB6DEE174A190F5DCCA9A971A7EF65267225AC23413221D38442E |
| SHA-512: | CD8687FA5C61F2A8F190860348567010F9D46360957DA0A82ECEDC97E33AE80BA3EC0C33F23E1C7DAF410CFEE8AEF14D12C5BDEC3AEB1DE6712CCE4AF0044074 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1568 |
| Entropy (8bit): | 6.335261083146529 |
| Encrypted: | false |
| SSDEEP: | 24:v+USUGlcAxSwwRLXnIgjf/pnxQwRlszT5sKt0er3eHVQj6TL2amhujJlOsIomNVn:GUpOxAbZnR6Tr3eHTa4JlIUNR4 |
| MD5: | 1A85F7DA80A862190436B47327A99A46 |
| SHA1: | 77F12AF6A42A146A03E30613B7EBEB8ACFE9B986 |
| SHA-256: | D4DD9A32658FB6DEE174A190F5DCCA9A971A7EF65267225AC23413221D38442E |
| SHA-512: | CD8687FA5C61F2A8F190860348567010F9D46360957DA0A82ECEDC97E33AE80BA3EC0C33F23E1C7DAF410CFEE8AEF14D12C5BDEC3AEB1DE6712CCE4AF0044074 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4096 |
| Entropy (8bit): | 2.0836444556178684 |
| Encrypted: | false |
| SSDEEP: | 24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl |
| MD5: | 8B40B1534FF0F4B533AF767EB5639A05 |
| SHA1: | 63EDB539EA39AD09D701A36B535C4C087AE08CC9 |
| SHA-256: | AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B |
| SHA-512: | 54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4537 |
| Entropy (8bit): | 5.033949607853121 |
| Encrypted: | false |
| SSDEEP: | 48:YrSAYrNO6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcb5:ychOyTEr5QFRzzcMvbw6KkCrrc2Rn27 |
| MD5: | B44D8050349E0BD0ACA44DA1BBA0DD73 |
| SHA1: | D6617F3E8C3390BA61A9DC061E58EAB75A2BB30D |
| SHA-256: | 32AE8AE826888A6E9EF5B7A792CB15FB343929F0F3F52F02AF65AD917E46807D |
| SHA-512: | 04E5BEA770D206552A46846F7013B2A49D7DB6091E4945F5D9968CE7D815ABAA404270ABF086E63133FA4C396677233AAB082B7679BAB9E5A67024529DFF888F |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp
Download File
| Process: | C:\Program Files\Mozilla Firefox\firefox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4537 |
| Entropy (8bit): | 5.033949607853121 |
| Encrypted: | false |
| SSDEEP: | 48:YrSAYrNO6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcb5:ychOyTEr5QFRzzcMvbw6KkCrrc2Rn27 |
| MD5: | B44D8050349E0BD0ACA44DA1BBA0DD73 |
| SHA1: | D6617F3E8C3390BA61A9DC061E58EAB75A2BB30D |
| SHA-256: | 32AE8AE826888A6E9EF5B7A792CB15FB343929F0F3F52F02AF65AD917E46807D |
| SHA-512: | 04E5BEA770D206552A46846F7013B2A49D7DB6091E4945F5D9968CE7D815ABAA404270ABF086E63133FA4C396677233AAB082B7679BAB9E5A67024529DFF888F |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.584665453698471 |
| TrID: |
|
| File name: | XlKQ797V2E.exe |
| File size: | 919'552 bytes |
| MD5: | 8d1d2122c8a31716baf394bb1e4c6f28 |
| SHA1: | b5eea46ea189e9c7b7172c5cca7b543eca377b48 |
| SHA256: | b122cc9290f58d4429c0e2bf1870777520493b95adf132a8a784d0dfa8495cf7 |
| SHA512: | 2e63bc9a9d3828f62c0596a2f72f9e215359407a8c8452bc1e4a1b5116a5306ff1389b651c1e3d1a5717bf34194ede75ba650110f2ef6f3f23ddfed35143c790 |
| SSDEEP: | 12288:NqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/To:NqDEvCTbMWu7rQYlBQcBiT6rprG8abo |
| TLSH: | B9159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x671DDC0E [Sun Oct 27 06:22:06 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F38047DC793h |
| jmp 00007F38047DC09Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F38047DC27Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F38047DC24Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F38047DEE3Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F38047DEE88h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F38047DEE71h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9c28 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9c28 | 0x9e00 | 4ccbd5c84990375215cc980073cbaca0 | False | 0.31559038765822783 | data | 5.373863059582051 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xef0 | data | 1.0028765690376569 | ||
| RT_GROUP_ICON | 0xdd6a8 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd720 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd734 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd748 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd75c | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd838 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 27, 2024 07:28:21.718990088 CET | 49736 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:21.719063997 CET | 443 | 49736 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:21.723829031 CET | 49736 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:21.729676962 CET | 49736 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:21.729718924 CET | 443 | 49736 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:22.363285065 CET | 443 | 49736 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:22.374320984 CET | 49736 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:22.385379076 CET | 49736 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:22.385428905 CET | 443 | 49736 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:22.385507107 CET | 49736 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:22.386145115 CET | 443 | 49736 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:22.390064955 CET | 49736 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:26.169655085 CET | 49739 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:26.175151110 CET | 80 | 49739 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.175379038 CET | 49739 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:26.175620079 CET | 49739 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:26.180951118 CET | 80 | 49739 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.192708969 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:26.192737103 CET | 443 | 49740 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.193579912 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:26.195550919 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:26.195568085 CET | 443 | 49740 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.785321951 CET | 80 | 49739 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.839248896 CET | 49739 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:26.963449955 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:26.963469982 CET | 443 | 49742 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.970837116 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:26.973267078 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:26.973282099 CET | 443 | 49742 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.071638107 CET | 443 | 49740 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.071794033 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.072628021 CET | 443 | 49740 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.073239088 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.078798056 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.078803062 CET | 443 | 49740 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.078927994 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.079113960 CET | 443 | 49740 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.079226971 CET | 49740 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.273242950 CET | 49743 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:27.278925896 CET | 80 | 49743 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.279767990 CET | 49743 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:27.279809952 CET | 49743 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:27.285640001 CET | 80 | 49743 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.356050968 CET | 49744 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.356121063 CET | 443 | 49744 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.356338024 CET | 49744 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.358535051 CET | 49744 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.358573914 CET | 443 | 49744 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.365315914 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:27.365339041 CET | 443 | 49745 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.372138977 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:27.372421026 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:27.372473001 CET | 443 | 49745 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.406573057 CET | 49746 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.406598091 CET | 443 | 49746 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.409785986 CET | 49746 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.415579081 CET | 49746 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.415606976 CET | 443 | 49746 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.451101065 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:27.451150894 CET | 443 | 49747 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.452907085 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:27.453078985 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:27.453094006 CET | 443 | 49747 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.843537092 CET | 443 | 49742 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.843554974 CET | 443 | 49742 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.843630075 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.844551086 CET | 443 | 49742 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.844641924 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.858524084 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.858544111 CET | 443 | 49742 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.858701944 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.859152079 CET | 443 | 49742 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.859226942 CET | 49748 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.859266043 CET | 443 | 49748 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.860745907 CET | 49742 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.860800982 CET | 49748 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.862921953 CET | 49748 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:27.862936974 CET | 443 | 49748 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.882883072 CET | 80 | 49743 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.987613916 CET | 443 | 49744 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.987730026 CET | 49744 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.990726948 CET | 443 | 49745 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.990740061 CET | 443 | 49745 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.990974903 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:27.995337009 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:27.995358944 CET | 443 | 49745 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.995635033 CET | 443 | 49745 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.999588966 CET | 49744 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.999619007 CET | 443 | 49744 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.999782085 CET | 49744 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:27.999911070 CET | 443 | 49744 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.999933958 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:28.000056982 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:28.000082016 CET | 443 | 49745 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.000462055 CET | 49749 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.000511885 CET | 443 | 49749 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.000554085 CET | 49744 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.000576019 CET | 49745 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:28.000741959 CET | 49749 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.002630949 CET | 49749 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.002650976 CET | 443 | 49749 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.011575937 CET | 49743 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:28.065356970 CET | 443 | 49747 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.065465927 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.069489956 CET | 443 | 49746 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.070149899 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.070162058 CET | 443 | 49747 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.070509911 CET | 49746 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.070599079 CET | 443 | 49747 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.076807022 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.076953888 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.076989889 CET | 443 | 49747 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.077430964 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.077474117 CET | 443 | 49750 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.078648090 CET | 49746 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.078663111 CET | 443 | 49746 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.078752995 CET | 49746 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.078950882 CET | 443 | 49746 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.079210997 CET | 49747 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.079276085 CET | 49746 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.079301119 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.079612970 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.079693079 CET | 443 | 49750 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.119667053 CET | 49743 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:28.119760036 CET | 49739 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:28.125900984 CET | 80 | 49743 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.125916004 CET | 80 | 49739 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.126703978 CET | 49743 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:28.126707077 CET | 49739 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:28.274456024 CET | 49751 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.274502039 CET | 443 | 49751 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.287497044 CET | 49751 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.289690971 CET | 49751 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.289707899 CET | 443 | 49751 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.630321980 CET | 443 | 49749 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.631099939 CET | 49749 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.679003000 CET | 49749 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.679037094 CET | 443 | 49749 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.679269075 CET | 49749 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.679742098 CET | 443 | 49749 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.679939032 CET | 49749 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.720038891 CET | 443 | 49748 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.721050978 CET | 443 | 49748 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.724230051 CET | 443 | 49750 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.731262922 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.731266022 CET | 49748 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:28.731285095 CET | 443 | 49748 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.743798018 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.743839979 CET | 443 | 49750 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.744694948 CET | 443 | 49750 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.747057915 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.747154951 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.747291088 CET | 49748 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:28.747308016 CET | 443 | 49748 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.747394085 CET | 49748 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:28.747500896 CET | 443 | 49750 | 34.160.144.191 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.747541904 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.747586966 CET | 443 | 49748 | 142.250.185.174 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.747688055 CET | 49750 | 443 | 192.168.2.4 | 34.160.144.191 |
| Oct 27, 2024 07:28:28.747703075 CET | 49748 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 27, 2024 07:28:28.902595997 CET | 443 | 49751 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.902611017 CET | 443 | 49751 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.903302908 CET | 49751 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.909643888 CET | 49751 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.909660101 CET | 443 | 49751 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.909800053 CET | 49751 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.909825087 CET | 443 | 49751 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.910320997 CET | 49752 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.910423994 CET | 443 | 49752 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:28.910465002 CET | 49751 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.913475990 CET | 49752 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.921328068 CET | 49752 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:28.921375990 CET | 443 | 49752 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.263675928 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:29.269074917 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.270395994 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:29.270534039 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:29.278301954 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.544857979 CET | 443 | 49752 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.544955969 CET | 49752 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:29.549860001 CET | 49752 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:29.549871922 CET | 443 | 49752 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.549971104 CET | 49752 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:29.550101042 CET | 443 | 49752 | 34.117.188.166 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.550196886 CET | 49752 | 443 | 192.168.2.4 | 34.117.188.166 |
| Oct 27, 2024 07:28:29.895798922 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.943304062 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:32.598304987 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:32.598911047 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:32.603743076 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.603964090 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:32.604038000 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:32.604223967 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.609594107 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.665239096 CET | 49760 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:32.665254116 CET | 443 | 49760 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.667098999 CET | 49760 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:32.669094086 CET | 49760 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:32.669173956 CET | 443 | 49760 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.729583025 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.782913923 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:33.205851078 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:33.253211975 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:33.285098076 CET | 443 | 49760 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:33.285202980 CET | 49760 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:33.291290045 CET | 49760 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:33.291290998 CET | 49760 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:33.291327953 CET | 443 | 49760 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:33.291531086 CET | 443 | 49760 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:33.296014071 CET | 49760 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:33.627523899 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:33.633057117 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:33.753709078 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:33.801498890 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:34.240859032 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:34.246377945 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:34.371437073 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:34.418802023 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:38.988126993 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:38.993489981 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.114547968 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.171590090 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:39.279412031 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:39.279428959 CET | 443 | 49763 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.279887915 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:39.281373024 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:39.281390905 CET | 443 | 49763 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.883760929 CET | 443 | 49763 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.891340017 CET | 443 | 49763 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.891436100 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:39.908497095 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:39.942373991 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:39.942373991 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:39.942425013 CET | 443 | 49763 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.942723036 CET | 443 | 49763 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.948579073 CET | 49763 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:40.566637039 CET | 49764 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:40.566688061 CET | 443 | 49764 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.566999912 CET | 49764 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:40.568871021 CET | 49764 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:40.568885088 CET | 443 | 49764 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.608248949 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:40.613727093 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.686969042 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:40.687005043 CET | 443 | 49765 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.687215090 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:40.687431097 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:40.687447071 CET | 443 | 49765 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.739882946 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.802812099 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:40.959562063 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:40.965003014 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.996932983 CET | 49766 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:40.996943951 CET | 443 | 49766 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.997416019 CET | 49766 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:40.999422073 CET | 49766 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:40.999439955 CET | 443 | 49766 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.086287022 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.134926081 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:41.192301989 CET | 443 | 49764 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.192398071 CET | 49764 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:41.220750093 CET | 49764 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:41.220763922 CET | 443 | 49764 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.220885038 CET | 49764 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:41.221128941 CET | 443 | 49764 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.221436977 CET | 49764 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:41.328604937 CET | 443 | 49765 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.329919100 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:41.355106115 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:41.355127096 CET | 443 | 49765 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.355462074 CET | 443 | 49765 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.355525970 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:41.359234095 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:41.359347105 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:41.359448910 CET | 443 | 49765 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.360929966 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.361845016 CET | 49765 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:41.368108988 CET | 49767 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:41.368119955 CET | 443 | 49767 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.368287086 CET | 49767 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:41.370148897 CET | 49767 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:41.370189905 CET | 443 | 49767 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.690601110 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.698410034 CET | 443 | 49766 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.705346107 CET | 49766 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:41.721812010 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.725383043 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:42.012439966 CET | 443 | 49767 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.019345045 CET | 443 | 49767 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.020246983 CET | 49767 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:42.463084936 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:42.464792013 CET | 49766 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:42.464816093 CET | 443 | 49766 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.464943886 CET | 49766 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:42.465327978 CET | 49767 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:42.465367079 CET | 443 | 49767 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.465425014 CET | 49767 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:42.465439081 CET | 443 | 49766 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.465656042 CET | 443 | 49767 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.467834949 CET | 49767 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:42.467839003 CET | 49766 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:42.468744993 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.589358091 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:42.641678095 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:43.902952909 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:43.908323050 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:43.932286978 CET | 49768 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:43.932315111 CET | 443 | 49768 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:43.932794094 CET | 49768 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:43.934268951 CET | 49768 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:43.934284925 CET | 443 | 49768 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.033444881 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.046431065 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.046454906 CET | 443 | 49769 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.046672106 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.046693087 CET | 443 | 49770 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.048666954 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.048930883 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.048933029 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.048984051 CET | 443 | 49769 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.049153090 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.049196005 CET | 443 | 49770 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.051327944 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:44.056646109 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.083934069 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:44.177887917 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.230808973 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:44.551153898 CET | 443 | 49768 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.551264048 CET | 49768 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.556670904 CET | 49768 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.556684971 CET | 443 | 49768 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.556863070 CET | 49768 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.556953907 CET | 443 | 49768 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.558142900 CET | 49768 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.559974909 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:44.565267086 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.670435905 CET | 443 | 49769 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.673475981 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.676826000 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.676836014 CET | 443 | 49769 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.677082062 CET | 443 | 49769 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.679680109 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.679889917 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.680073977 CET | 443 | 49769 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.680490017 CET | 49769 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.680532932 CET | 443 | 49770 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.680694103 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.683394909 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.683402061 CET | 443 | 49770 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.684179068 CET | 443 | 49770 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.686392069 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.686499119 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.686774015 CET | 443 | 49770 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.687004089 CET | 49770 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:28:44.690581083 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.693950891 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:44.699412107 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.732273102 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:44.820276976 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:44.870434046 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:50.165806055 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.165818930 CET | 443 | 49771 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.168642044 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.168920040 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.168946028 CET | 443 | 49771 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.189273119 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.189289093 CET | 443 | 49772 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.191176891 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.191298008 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.191314936 CET | 443 | 49772 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.194540977 CET | 49773 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:50.194561005 CET | 443 | 49773 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.201281071 CET | 49773 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:50.205683947 CET | 49773 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:50.205696106 CET | 443 | 49773 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.206090927 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.206166983 CET | 443 | 49774 | 151.101.65.91 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.206199884 CET | 49775 | 443 | 192.168.2.4 | 35.201.103.21 |
| Oct 27, 2024 07:28:50.206208944 CET | 443 | 49775 | 35.201.103.21 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.208013058 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.208090067 CET | 49775 | 443 | 192.168.2.4 | 35.201.103.21 |
| Oct 27, 2024 07:28:50.208142042 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.208163023 CET | 443 | 49774 | 151.101.65.91 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.209582090 CET | 49775 | 443 | 192.168.2.4 | 35.201.103.21 |
| Oct 27, 2024 07:28:50.209597111 CET | 443 | 49775 | 35.201.103.21 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.681214094 CET | 49776 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:50.681226015 CET | 443 | 49776 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.681615114 CET | 49776 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:50.683056116 CET | 49776 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:50.683068991 CET | 443 | 49776 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.783776999 CET | 443 | 49771 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.783885002 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.787380934 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.787395954 CET | 443 | 49771 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.787754059 CET | 443 | 49771 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.790273905 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.790352106 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.790535927 CET | 443 | 49771 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.790600061 CET | 49771 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.794011116 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:50.799474955 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.800816059 CET | 443 | 49772 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.800934076 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.804044962 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.804095030 CET | 443 | 49772 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.804410934 CET | 443 | 49772 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.806605101 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.806736946 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.806775093 CET | 443 | 49772 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.807154894 CET | 49772 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.823594093 CET | 443 | 49773 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.823613882 CET | 443 | 49773 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.823676109 CET | 49773 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:50.828296900 CET | 443 | 49774 | 151.101.65.91 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.828396082 CET | 49773 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:50.828421116 CET | 443 | 49773 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.828450918 CET | 49773 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:50.828608036 CET | 443 | 49773 | 35.190.72.216 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.829040051 CET | 49773 | 443 | 192.168.2.4 | 35.190.72.216 |
| Oct 27, 2024 07:28:50.829040051 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.831801891 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.831810951 CET | 443 | 49774 | 151.101.65.91 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.832194090 CET | 443 | 49774 | 151.101.65.91 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.832571983 CET | 443 | 49775 | 35.201.103.21 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.832648039 CET | 49775 | 443 | 192.168.2.4 | 35.201.103.21 |
| Oct 27, 2024 07:28:50.836225033 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.836314917 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.836462021 CET | 443 | 49774 | 151.101.65.91 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.836808920 CET | 49774 | 443 | 192.168.2.4 | 151.101.65.91 |
| Oct 27, 2024 07:28:50.837682009 CET | 49775 | 443 | 192.168.2.4 | 35.201.103.21 |
| Oct 27, 2024 07:28:50.837688923 CET | 443 | 49775 | 35.201.103.21 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.837759972 CET | 49775 | 443 | 192.168.2.4 | 35.201.103.21 |
| Oct 27, 2024 07:28:50.837935925 CET | 443 | 49775 | 35.201.103.21 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.843914032 CET | 49775 | 443 | 192.168.2.4 | 35.201.103.21 |
| Oct 27, 2024 07:28:50.846374989 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.846389055 CET | 443 | 49777 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.846626997 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.846740007 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.846749067 CET | 443 | 49777 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.852168083 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.852180958 CET | 443 | 49778 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.852984905 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.853008986 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.853038073 CET | 443 | 49779 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.853040934 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.853096008 CET | 443 | 49778 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.853329897 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.853389978 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:50.853394985 CET | 443 | 49779 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.857405901 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.857414961 CET | 443 | 49780 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.857533932 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.857661009 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:50.857676983 CET | 443 | 49780 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.924565077 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.929570913 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:50.935308933 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.974845886 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:51.055958986 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.106401920 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:51.291137934 CET | 443 | 49776 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.291275978 CET | 49776 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:51.297439098 CET | 49776 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:51.297439098 CET | 49776 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:51.297461987 CET | 443 | 49776 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.297708988 CET | 443 | 49776 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.297794104 CET | 49776 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:28:51.300422907 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:51.305768013 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.431063890 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.434789896 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:51.440150023 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.447737932 CET | 443 | 49777 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.447855949 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.451001883 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.451014042 CET | 443 | 49777 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.451371908 CET | 443 | 49777 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.452662945 CET | 443 | 49779 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.452750921 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.455131054 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.455142021 CET | 443 | 49779 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.455492973 CET | 443 | 49779 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.456059933 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.456147909 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.456326962 CET | 443 | 49777 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.458641052 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.458679914 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.458810091 CET | 443 | 49779 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.461529970 CET | 443 | 49780 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.462201118 CET | 443 | 49778 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.464991093 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:51.465061903 CET | 49777 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.465061903 CET | 49779 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.465353966 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:51.465522051 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.466347933 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:51.466370106 CET | 443 | 49780 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.467417955 CET | 443 | 49780 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.470308065 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.470505953 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.470591068 CET | 443 | 49778 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.471009970 CET | 443 | 49778 | 35.244.181.201 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.472953081 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:51.472995996 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:51.473409891 CET | 443 | 49780 | 34.149.100.209 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.473469019 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.473469019 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.473562002 CET | 49780 | 443 | 192.168.2.4 | 34.149.100.209 |
| Oct 27, 2024 07:28:51.473587990 CET | 49778 | 443 | 192.168.2.4 | 35.244.181.201 |
| Oct 27, 2024 07:28:51.561871052 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.595792055 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.598958015 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:51.604404926 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.639132023 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:51.725107908 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:51.777228117 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:58.843609095 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:59.069490910 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:59.194645882 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:59.198298931 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:59.203790903 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:59.244242907 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:28:59.325532913 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:28:59.376497030 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:09.203813076 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:09.209186077 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:09.335377932 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:09.340835094 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.126950026 CET | 49830 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:12.126970053 CET | 443 | 49830 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.127115965 CET | 49830 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:12.128724098 CET | 49830 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:12.128741026 CET | 443 | 49830 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.742239952 CET | 443 | 49830 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.742316961 CET | 49830 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:12.747157097 CET | 49830 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:12.747164011 CET | 443 | 49830 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.747257948 CET | 49830 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:12.747356892 CET | 443 | 49830 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.748269081 CET | 49830 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:12.750042915 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:12.755506992 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.881683111 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.885284901 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:12.890645027 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.930080891 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:13.139952898 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:13.140010118 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:13.140889883 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:13.184053898 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:20.027283907 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.027292013 CET | 443 | 49874 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.027456045 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.027473927 CET | 443 | 49875 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.029794931 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.029966116 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.029968023 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.029978991 CET | 443 | 49874 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.030184031 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.030201912 CET | 443 | 49875 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.030493975 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.030503035 CET | 443 | 49876 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.035234928 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.035427094 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.035440922 CET | 443 | 49876 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.631685972 CET | 443 | 49874 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.634006023 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.638199091 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.638206959 CET | 443 | 49874 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.638550043 CET | 443 | 49874 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.641938925 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.641938925 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.642127037 CET | 443 | 49874 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.642443895 CET | 49874 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.644671917 CET | 443 | 49875 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.645795107 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.649719000 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.649744034 CET | 443 | 49875 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.650053024 CET | 443 | 49875 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.652162075 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.652188063 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.652314901 CET | 443 | 49875 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.652566910 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.652566910 CET | 49875 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.671302080 CET | 443 | 49876 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.671509981 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.675471067 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.675478935 CET | 443 | 49876 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.675805092 CET | 443 | 49876 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.678193092 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.678297043 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.678381920 CET | 443 | 49876 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.678921938 CET | 49876 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.709819078 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:20.711507082 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.711530924 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.715203047 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.719798088 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.719932079 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.719948053 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.761981964 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.761995077 CET | 443 | 49881 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.762116909 CET | 49882 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.762131929 CET | 443 | 49882 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.762219906 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.762234926 CET | 443 | 49883 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.765012980 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.765230894 CET | 49882 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.765232086 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.765232086 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.765245914 CET | 443 | 49881 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.765415907 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.765428066 CET | 443 | 49883 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.765552998 CET | 49882 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:20.765568972 CET | 443 | 49882 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.840224981 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:20.897008896 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:20.900995970 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:20.902436018 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.023127079 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.082844973 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:21.345191956 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.345216036 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.345284939 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.349361897 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.349375963 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.349854946 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.351893902 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.352083921 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.352190971 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.352199078 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.355086088 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:21.360451937 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.371165991 CET | 443 | 49883 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.371238947 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.372657061 CET | 443 | 49882 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.375190020 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.375199080 CET | 443 | 49883 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.375629902 CET | 49882 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.375863075 CET | 443 | 49883 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.378057003 CET | 49882 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.378063917 CET | 443 | 49882 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.378330946 CET | 443 | 49882 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.380151033 CET | 443 | 49881 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.380523920 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.380781889 CET | 443 | 49883 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.381124973 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.381130934 CET | 443 | 49883 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.382215023 CET | 49882 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.382222891 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.382322073 CET | 49882 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.382322073 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.382322073 CET | 49883 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.382322073 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.385806084 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.385809898 CET | 443 | 49881 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.386128902 CET | 443 | 49881 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.388277054 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.388333082 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.388461113 CET | 443 | 49881 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.389349937 CET | 49881 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.485666037 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.488802910 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:21.494252920 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.538631916 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:21.567358971 CET | 443 | 49880 | 34.120.208.123 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.567488909 CET | 49880 | 443 | 192.168.2.4 | 34.120.208.123 |
| Oct 27, 2024 07:29:21.614976883 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:21.661134958 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:31.489442110 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:31.494705915 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:31.620964050 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:31.626372099 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:41.518640995 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:41.524097919 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:41.634540081 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:41.642174006 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:51.547110081 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:51.552464962 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:51.647084951 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:51.652386904 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:52.762849092 CET | 50057 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:52.762883902 CET | 443 | 50057 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:52.762976885 CET | 50057 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:52.765116930 CET | 50057 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:52.765141964 CET | 443 | 50057 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.371603966 CET | 443 | 50057 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.371691942 CET | 50057 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:53.379036903 CET | 50057 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:53.379045010 CET | 443 | 50057 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.379170895 CET | 50057 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:53.379242897 CET | 443 | 50057 | 34.107.243.93 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.380600929 CET | 50057 | 443 | 192.168.2.4 | 34.107.243.93 |
| Oct 27, 2024 07:29:53.382208109 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:53.387512922 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.512733936 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.518156052 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:53.523591042 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.552774906 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:29:53.644171000 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.684501886 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:30:03.528141022 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:30:03.534091949 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:30:03.659699917 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:30:03.665100098 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:30:13.542253017 CET | 49753 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:30:13.547811985 CET | 80 | 49753 | 34.107.221.82 | 192.168.2.4 |
| Oct 27, 2024 07:30:13.673917055 CET | 49759 | 80 | 192.168.2.4 | 34.107.221.82 |
| Oct 27, 2024 07:30:13.679388046 CET | 80 | 49759 | 34.107.221.82 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 27, 2024 07:28:21.719727993 CET | 49364 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:21.727731943 CET | 53 | 49364 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:21.728611946 CET | 54851 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:21.736223936 CET | 53 | 54851 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:24.172732115 CET | 62757 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:24.206489086 CET | 54273 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:24.215372086 CET | 53 | 54273 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:24.223434925 CET | 57990 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:24.232280970 CET | 53 | 57990 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.184448004 CET | 65418 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:26.191837072 CET | 53 | 65418 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.193475008 CET | 55797 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:26.201299906 CET | 53 | 55797 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.202243090 CET | 49202 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:26.209986925 CET | 53 | 49202 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.970210075 CET | 50988 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:26.978142023 CET | 53 | 50988 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:26.985461950 CET | 49934 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:26.993187904 CET | 53 | 49934 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.262219906 CET | 58865 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.341206074 CET | 64301 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.348649979 CET | 53 | 64301 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.356816053 CET | 62753 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.364125967 CET | 53 | 62753 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.365658045 CET | 61873 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.373565912 CET | 53 | 61873 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.375286102 CET | 56968 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.380928993 CET | 50956 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.382498026 CET | 53 | 56968 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.388674021 CET | 53 | 50956 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.396774054 CET | 55958 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.404382944 CET | 53 | 55958 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.407141924 CET | 56675 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.415245056 CET | 53 | 56675 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.417061090 CET | 64546 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.425013065 CET | 53 | 64546 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.433715105 CET | 52344 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.441060066 CET | 53 | 52344 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.451998949 CET | 54309 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.460480928 CET | 53 | 54309 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:27.461138010 CET | 51140 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:27.468827009 CET | 53 | 51140 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:29.260929108 CET | 55204 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:29.263385057 CET | 60568 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:29.305529118 CET | 53 | 63595 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.386495113 CET | 58932 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:32.394315958 CET | 53 | 58932 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.397892952 CET | 64001 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:32.405155897 CET | 53 | 64001 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:32.405810118 CET | 55252 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:32.413233042 CET | 53 | 55252 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:38.703948021 CET | 55246 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:38.711471081 CET | 53 | 55246 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:38.715142965 CET | 50490 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:38.723336935 CET | 53 | 50490 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:38.724370003 CET | 60939 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:38.732817888 CET | 53 | 60939 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:39.279830933 CET | 60159 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:39.287950993 CET | 53 | 60159 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.566967964 CET | 51096 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:40.574284077 CET | 53 | 51096 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.577080965 CET | 53426 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:40.585366011 CET | 53 | 53426 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.682445049 CET | 60724 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:40.689791918 CET | 53 | 60724 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.988514900 CET | 56844 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:40.995712042 CET | 53 | 56844 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:40.997292995 CET | 57014 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:41.005151033 CET | 53 | 57014 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:41.009423018 CET | 49582 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:41.016617060 CET | 53 | 49582 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.699631929 CET | 57455 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.699681044 CET | 54239 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.699978113 CET | 62966 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.707022905 CET | 53 | 62966 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.707060099 CET | 53 | 57455 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.707864046 CET | 53 | 54239 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.709054947 CET | 64673 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.709377050 CET | 65011 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.710797071 CET | 50094 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.716667891 CET | 53 | 64673 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.716754913 CET | 53 | 65011 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.718416929 CET | 53 | 50094 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.718763113 CET | 53196 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.718763113 CET | 57012 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.719315052 CET | 63379 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.725991964 CET | 53 | 57012 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.726421118 CET | 53 | 53196 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.726596117 CET | 53 | 63379 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.726838112 CET | 56705 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.727282047 CET | 52849 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.734181881 CET | 53 | 56705 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.734657049 CET | 53 | 52849 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.734841108 CET | 63527 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.735517979 CET | 56274 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.742645025 CET | 53 | 56274 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.742675066 CET | 53 | 63527 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.743192911 CET | 57706 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.743508101 CET | 54732 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:46.751142979 CET | 53 | 57706 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:46.751635075 CET | 53 | 54732 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.167361975 CET | 58333 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.176542044 CET | 53 | 58333 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.185900927 CET | 53596 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.194947958 CET | 51705 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.196571112 CET | 53 | 53596 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.202507973 CET | 57052 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.202516079 CET | 53 | 51705 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.207325935 CET | 63918 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.211113930 CET | 53 | 57052 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.213778019 CET | 60339 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.215020895 CET | 53 | 63918 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.222186089 CET | 53 | 60339 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.224623919 CET | 59446 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.231985092 CET | 53 | 59446 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.680111885 CET | 64057 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.687392950 CET | 53 | 64057 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:28:50.688582897 CET | 56875 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:28:50.696453094 CET | 53 | 56875 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.118652105 CET | 64772 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:29:12.125952959 CET | 53 | 64772 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.126842022 CET | 52164 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:29:12.134443045 CET | 53 | 52164 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:29:12.750289917 CET | 49927 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:29:20.059968948 CET | 52046 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:29:20.067653894 CET | 53 | 52046 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:29:52.753699064 CET | 60333 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:29:52.761430979 CET | 53 | 60333 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:29:52.762557983 CET | 58972 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:29:52.769968033 CET | 53 | 58972 | 1.1.1.1 | 192.168.2.4 |
| Oct 27, 2024 07:29:53.383131027 CET | 59651 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 27, 2024 07:29:53.392029047 CET | 53 | 59651 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 27, 2024 07:28:21.719727993 CET | 192.168.2.4 | 1.1.1.1 | 0xb1ec | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:21.728611946 CET | 192.168.2.4 | 1.1.1.1 | 0x6f6 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:24.172732115 CET | 192.168.2.4 | 1.1.1.1 | 0x634b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:24.206489086 CET | 192.168.2.4 | 1.1.1.1 | 0xdcae | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:24.223434925 CET | 192.168.2.4 | 1.1.1.1 | 0x8b49 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:26.184448004 CET | 192.168.2.4 | 1.1.1.1 | 0x9d31 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:26.193475008 CET | 192.168.2.4 | 1.1.1.1 | 0x449f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:26.202243090 CET | 192.168.2.4 | 1.1.1.1 | 0x1f79 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:26.970210075 CET | 192.168.2.4 | 1.1.1.1 | 0xc157 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:26.985461950 CET | 192.168.2.4 | 1.1.1.1 | 0xa49d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.262219906 CET | 192.168.2.4 | 1.1.1.1 | 0xcf15 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.341206074 CET | 192.168.2.4 | 1.1.1.1 | 0xcfd1 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.356816053 CET | 192.168.2.4 | 1.1.1.1 | 0xcec0 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.365658045 CET | 192.168.2.4 | 1.1.1.1 | 0x8383 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.375286102 CET | 192.168.2.4 | 1.1.1.1 | 0x278f | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.380928993 CET | 192.168.2.4 | 1.1.1.1 | 0x2119 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.396774054 CET | 192.168.2.4 | 1.1.1.1 | 0xad76 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.407141924 CET | 192.168.2.4 | 1.1.1.1 | 0x2c1 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.417061090 CET | 192.168.2.4 | 1.1.1.1 | 0x6a06 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.433715105 CET | 192.168.2.4 | 1.1.1.1 | 0xe9b5 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.451998949 CET | 192.168.2.4 | 1.1.1.1 | 0xfa53 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:27.461138010 CET | 192.168.2.4 | 1.1.1.1 | 0x2876 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:29.260929108 CET | 192.168.2.4 | 1.1.1.1 | 0xa8fa | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:29.263385057 CET | 192.168.2.4 | 1.1.1.1 | 0x668b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:32.386495113 CET | 192.168.2.4 | 1.1.1.1 | 0xb979 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:32.397892952 CET | 192.168.2.4 | 1.1.1.1 | 0x6591 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:32.405810118 CET | 192.168.2.4 | 1.1.1.1 | 0x7ba9 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:38.703948021 CET | 192.168.2.4 | 1.1.1.1 | 0xc20c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:38.715142965 CET | 192.168.2.4 | 1.1.1.1 | 0xc4bb | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:38.724370003 CET | 192.168.2.4 | 1.1.1.1 | 0xb874 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:39.279830933 CET | 192.168.2.4 | 1.1.1.1 | 0xe669 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:40.566967964 CET | 192.168.2.4 | 1.1.1.1 | 0x43cf | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:40.577080965 CET | 192.168.2.4 | 1.1.1.1 | 0x41bd | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:40.682445049 CET | 192.168.2.4 | 1.1.1.1 | 0xac66 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:40.988514900 CET | 192.168.2.4 | 1.1.1.1 | 0x4524 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:40.997292995 CET | 192.168.2.4 | 1.1.1.1 | 0xce12 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:41.009423018 CET | 192.168.2.4 | 1.1.1.1 | 0x550c | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.699631929 CET | 192.168.2.4 | 1.1.1.1 | 0x6262 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.699681044 CET | 192.168.2.4 | 1.1.1.1 | 0xf855 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.699978113 CET | 192.168.2.4 | 1.1.1.1 | 0x95d8 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.709054947 CET | 192.168.2.4 | 1.1.1.1 | 0xb986 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.709377050 CET | 192.168.2.4 | 1.1.1.1 | 0xe201 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.710797071 CET | 192.168.2.4 | 1.1.1.1 | 0x6938 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.718763113 CET | 192.168.2.4 | 1.1.1.1 | 0x632a | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.718763113 CET | 192.168.2.4 | 1.1.1.1 | 0x9669 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.719315052 CET | 192.168.2.4 | 1.1.1.1 | 0xa80 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.726838112 CET | 192.168.2.4 | 1.1.1.1 | 0x47e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.727282047 CET | 192.168.2.4 | 1.1.1.1 | 0x7d43 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.734841108 CET | 192.168.2.4 | 1.1.1.1 | 0x1a8e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.735517979 CET | 192.168.2.4 | 1.1.1.1 | 0xcd1b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.743192911 CET | 192.168.2.4 | 1.1.1.1 | 0x9e48 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:46.743508101 CET | 192.168.2.4 | 1.1.1.1 | 0x92bb | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.167361975 CET | 192.168.2.4 | 1.1.1.1 | 0x4cf9 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.185900927 CET | 192.168.2.4 | 1.1.1.1 | 0x20da | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.194947958 CET | 192.168.2.4 | 1.1.1.1 | 0x301e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.202507973 CET | 192.168.2.4 | 1.1.1.1 | 0xac8b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.207325935 CET | 192.168.2.4 | 1.1.1.1 | 0x2336 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.213778019 CET | 192.168.2.4 | 1.1.1.1 | 0x46f0 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.224623919 CET | 192.168.2.4 | 1.1.1.1 | 0x7e88 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.680111885 CET | 192.168.2.4 | 1.1.1.1 | 0x1ad3 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:28:50.688582897 CET | 192.168.2.4 | 1.1.1.1 | 0x9cbe | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:29:12.118652105 CET | 192.168.2.4 | 1.1.1.1 | 0x5391 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:29:12.126842022 CET | 192.168.2.4 | 1.1.1.1 | 0xca23 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:29:12.750289917 CET | 192.168.2.4 | 1.1.1.1 | 0x3d44 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:29:20.059968948 CET | 192.168.2.4 | 1.1.1.1 | 0xff86 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:29:52.753699064 CET | 192.168.2.4 | 1.1.1.1 | 0xcd7 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 27, 2024 07:29:52.762557983 CET | 192.168.2.4 | 1.1.1.1 | 0x429 | Standard query (0) | 28 | IN (0x0001) | false | |
| Oct 27, 2024 07:29:53.383131027 CET | 192.168.2.4 | 1.1.1.1 | 0xe6f5 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 27, 2024 07:28:21.714222908 CET | 1.1.1.1 | 192.168.2.4 | 0xaa3f | No error (0) | 35.190.72.216 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:21.727731943 CET | 1.1.1.1 | 192.168.2.4 | 0xb1ec | No error (0) | 35.190.72.216 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:24.180593014 CET | 1.1.1.1 | 192.168.2.4 | 0x634b | No error (0) | detectportal.prod.mozaws.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:24.180593014 CET | 1.1.1.1 | 192.168.2.4 | 0x634b | No error (0) | 34.107.221.82 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:24.215372086 CET | 1.1.1.1 | 192.168.2.4 | 0xdcae | No error (0) | 34.107.221.82 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:24.232280970 CET | 1.1.1.1 | 192.168.2.4 | 0x8b49 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:26.191837072 CET | 1.1.1.1 | 192.168.2.4 | 0x9d31 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:26.201299906 CET | 1.1.1.1 | 192.168.2.4 | 0x449f | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:26.209986925 CET | 1.1.1.1 | 192.168.2.4 | 0x1f79 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:26.978142023 CET | 1.1.1.1 | 192.168.2.4 | 0xc157 | No error (0) | 93.184.215.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:26.993187904 CET | 1.1.1.1 | 192.168.2.4 | 0xa49d | No error (0) | 192.0.0.171 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:26.993187904 CET | 1.1.1.1 | 192.168.2.4 | 0xa49d | No error (0) | 192.0.0.170 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.270047903 CET | 1.1.1.1 | 192.168.2.4 | 0xcf15 | No error (0) | detectportal.prod.mozaws.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.270047903 CET | 1.1.1.1 | 192.168.2.4 | 0xcf15 | No error (0) | 34.107.221.82 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.348649979 CET | 1.1.1.1 | 192.168.2.4 | 0xcfd1 | No error (0) | 34.117.188.166 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.352648973 CET | 1.1.1.1 | 192.168.2.4 | 0x97a5 | No error (0) | prod.balrog.prod.cloudops.mozgcp.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.352648973 CET | 1.1.1.1 | 192.168.2.4 | 0x97a5 | No error (0) | 35.244.181.201 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.364125967 CET | 1.1.1.1 | 192.168.2.4 | 0xcec0 | No error (0) | 34.117.188.166 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.373565912 CET | 1.1.1.1 | 192.168.2.4 | 0x8383 | No error (0) | 35.244.181.201 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.388674021 CET | 1.1.1.1 | 192.168.2.4 | 0x2119 | No error (0) | prod.ads.prod.webservices.mozgcp.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.388674021 CET | 1.1.1.1 | 192.168.2.4 | 0x2119 | No error (0) | 34.117.188.166 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.415245056 CET | 1.1.1.1 | 192.168.2.4 | 0x2c1 | No error (0) | 34.117.188.166 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.441060066 CET | 1.1.1.1 | 192.168.2.4 | 0xe9b5 | No error (0) | content-signature-chains.prod.autograph.services.mozaws.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.441060066 CET | 1.1.1.1 | 192.168.2.4 | 0xe9b5 | No error (0) | prod.content-signature-chains.prod.webservices.mozgcp.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.441060066 CET | 1.1.1.1 | 192.168.2.4 | 0xe9b5 | No error (0) | 34.160.144.191 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.460480928 CET | 1.1.1.1 | 192.168.2.4 | 0xfa53 | No error (0) | 34.160.144.191 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:27.468827009 CET | 1.1.1.1 | 192.168.2.4 | 0x2876 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:29.268904924 CET | 1.1.1.1 | 192.168.2.4 | 0xa8fa | No error (0) | detectportal.prod.mozaws.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:29.268904924 CET | 1.1.1.1 | 192.168.2.4 | 0xa8fa | No error (0) | 34.107.221.82 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:29.271930933 CET | 1.1.1.1 | 192.168.2.4 | 0x668b | No error (0) | shavar.prod.mozaws.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:32.394315958 CET | 1.1.1.1 | 192.168.2.4 | 0xb979 | No error (0) | 34.107.243.93 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:32.405155897 CET | 1.1.1.1 | 192.168.2.4 | 0x6591 | No error (0) | 34.107.243.93 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:38.711471081 CET | 1.1.1.1 | 192.168.2.4 | 0xc20c | No error (0) | prod.sumo.prod.webservices.mozgcp.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:38.711471081 CET | 1.1.1.1 | 192.168.2.4 | 0xc20c | No error (0) | us-west1.prod.sumo.prod.webservices.mozgcp.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:38.711471081 CET | 1.1.1.1 | 192.168.2.4 | 0xc20c | No error (0) | 34.149.128.2 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:38.723336935 CET | 1.1.1.1 | 192.168.2.4 | 0xc4bb | No error (0) | 34.149.128.2 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:40.565418005 CET | 1.1.1.1 | 192.168.2.4 | 0x99ff | No error (0) | 34.120.208.123 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:40.574284077 CET | 1.1.1.1 | 192.168.2.4 | 0x43cf | No error (0) | 34.120.208.123 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:40.681468964 CET | 1.1.1.1 | 192.168.2.4 | 0x6c4a | No error (0) | prod.balrog.prod.cloudops.mozgcp.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:40.681468964 CET | 1.1.1.1 | 192.168.2.4 | 0x6c4a | No error (0) | 35.244.181.201 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:40.995712042 CET | 1.1.1.1 | 192.168.2.4 | 0x4524 | No error (0) | prod.remote-settings.prod.webservices.mozgcp.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:40.995712042 CET | 1.1.1.1 | 192.168.2.4 | 0x4524 | No error (0) | 34.149.100.209 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:41.005151033 CET | 1.1.1.1 | 192.168.2.4 | 0xce12 | No error (0) | 34.149.100.209 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:41.366738081 CET | 1.1.1.1 | 192.168.2.4 | 0xf500 | No error (0) | 34.120.208.123 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707022905 CET | 1.1.1.1 | 192.168.2.4 | 0x95d8 | No error (0) | dyna.wikimedia.org | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707022905 CET | 1.1.1.1 | 192.168.2.4 | 0x95d8 | No error (0) | 185.15.59.224 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707060099 CET | 1.1.1.1 | 192.168.2.4 | 0x6262 | No error (0) | star-mini.c10r.facebook.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707060099 CET | 1.1.1.1 | 192.168.2.4 | 0x6262 | No error (0) | 157.240.251.35 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 172.217.23.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.74.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 172.217.18.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.707864046 CET | 1.1.1.1 | 192.168.2.4 | 0xf855 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.716667891 CET | 1.1.1.1 | 192.168.2.4 | 0xb986 | No error (0) | 185.15.59.224 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.716754913 CET | 1.1.1.1 | 192.168.2.4 | 0xe201 | No error (0) | 157.240.0.35 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 172.217.18.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.718416929 CET | 1.1.1.1 | 192.168.2.4 | 0x6938 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.725991964 CET | 1.1.1.1 | 192.168.2.4 | 0x9669 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:46.726421118 CET | 1.1.1.1 | 192.168.2.4 | 0x632a | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:46.726596117 CET | 1.1.1.1 | 192.168.2.4 | 0xa80 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:46.726596117 CET | 1.1.1.1 | 192.168.2.4 | 0xa80 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:46.726596117 CET | 1.1.1.1 | 192.168.2.4 | 0xa80 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:46.726596117 CET | 1.1.1.1 | 192.168.2.4 | 0xa80 | No error (0) | 28 | IN (0x0001) | false | |||
| Oct 27, 2024 07:28:46.734181881 CET | 1.1.1.1 | 192.168.2.4 | 0x47e | No error (0) | reddit.map.fastly.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.734181881 CET | 1.1.1.1 | 192.168.2.4 | 0x47e | No error (0) | 151.101.1.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.734181881 CET | 1.1.1.1 | 192.168.2.4 | 0x47e | No error (0) | 151.101.65.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.734181881 CET | 1.1.1.1 | 192.168.2.4 | 0x47e | No error (0) | 151.101.193.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.734181881 CET | 1.1.1.1 | 192.168.2.4 | 0x47e | No error (0) | 151.101.129.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.734657049 CET | 1.1.1.1 | 192.168.2.4 | 0x7d43 | No error (0) | 104.244.42.1 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.742645025 CET | 1.1.1.1 | 192.168.2.4 | 0xcd1b | No error (0) | 104.244.42.193 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.742675066 CET | 1.1.1.1 | 192.168.2.4 | 0x1a8e | No error (0) | 151.101.129.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.742675066 CET | 1.1.1.1 | 192.168.2.4 | 0x1a8e | No error (0) | 151.101.193.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.742675066 CET | 1.1.1.1 | 192.168.2.4 | 0x1a8e | No error (0) | 151.101.65.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:46.742675066 CET | 1.1.1.1 | 192.168.2.4 | 0x1a8e | No error (0) | 151.101.1.140 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.196571112 CET | 1.1.1.1 | 192.168.2.4 | 0x20da | No error (0) | 151.101.65.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.196571112 CET | 1.1.1.1 | 192.168.2.4 | 0x20da | No error (0) | 151.101.1.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.196571112 CET | 1.1.1.1 | 192.168.2.4 | 0x20da | No error (0) | 151.101.129.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.196571112 CET | 1.1.1.1 | 192.168.2.4 | 0x20da | No error (0) | 151.101.193.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.202516079 CET | 1.1.1.1 | 192.168.2.4 | 0x301e | No error (0) | normandy-cdn.services.mozilla.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.202516079 CET | 1.1.1.1 | 192.168.2.4 | 0x301e | No error (0) | 35.201.103.21 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.211113930 CET | 1.1.1.1 | 192.168.2.4 | 0xac8b | No error (0) | 151.101.1.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.211113930 CET | 1.1.1.1 | 192.168.2.4 | 0xac8b | No error (0) | 151.101.65.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.211113930 CET | 1.1.1.1 | 192.168.2.4 | 0xac8b | No error (0) | 151.101.129.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.211113930 CET | 1.1.1.1 | 192.168.2.4 | 0xac8b | No error (0) | 151.101.193.91 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.215020895 CET | 1.1.1.1 | 192.168.2.4 | 0x2336 | No error (0) | 35.201.103.21 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:50.687392950 CET | 1.1.1.1 | 192.168.2.4 | 0x1ad3 | No error (0) | 34.107.243.93 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:51.516128063 CET | 1.1.1.1 | 192.168.2.4 | 0xd0a4 | No error (0) | a17.rackcdn.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:28:51.516128063 CET | 1.1.1.1 | 192.168.2.4 | 0xd0a4 | No error (0) | a17.rackcdn.com.mdc.edgesuite.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:29:12.125952959 CET | 1.1.1.1 | 192.168.2.4 | 0x5391 | No error (0) | 34.107.243.93 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:29:12.757575035 CET | 1.1.1.1 | 192.168.2.4 | 0x3d44 | No error (0) | detectportal.prod.mozaws.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 27, 2024 07:29:12.757575035 CET | 1.1.1.1 | 192.168.2.4 | 0x3d44 | No error (0) | 34.107.221.82 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:29:20.034079075 CET | 1.1.1.1 | 192.168.2.4 | 0xd5bf | No error (0) | 34.120.208.123 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:29:52.761430979 CET | 1.1.1.1 | 192.168.2.4 | 0xcd7 | No error (0) | 34.107.243.93 | A (IP address) | IN (0x0001) | false | ||
| Oct 27, 2024 07:29:53.392029047 CET | 1.1.1.1 | 192.168.2.4 | 0xe6f5 | No error (0) | 34.107.221.82 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49739 | 34.107.221.82 | 80 | 6784 | C:\Program Files\Mozilla Firefox\firefox.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Oct 27, 2024 07:28:26.175620079 CET | 303 | OUT | |
| Oct 27, 2024 07:28:26.785321951 CET | 298 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49743 | 34.107.221.82 | 80 | 6784 | C:\Program Files\Mozilla Firefox\firefox.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Oct 27, 2024 07:28:27.279809952 CET | 305 | OUT | |
| Oct 27, 2024 07:28:27.882883072 CET | 216 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49753 | 34.107.221.82 | 80 | 6784 | C:\Program Files\Mozilla Firefox\firefox.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Oct 27, 2024 07:28:29.270534039 CET | 303 | OUT | |
| Oct 27, 2024 07:28:29.895798922 CET | 298 | IN | |
| Oct 27, 2024 07:28:32.598911047 CET | 303 | OUT | |
| Oct 27, 2024 07:28:32.729583025 CET | 298 | IN | |
| Oct 27, 2024 07:28:34.240859032 CET | 303 | OUT | |
| Oct 27, 2024 07:28:34.371437073 CET | 298 | IN | |
| Oct 27, 2024 07:28:40.608248949 CET | 303 | OUT | |
| Oct 27, 2024 07:28:40.739882946 CET | 298 | IN | |
| Oct 27, 2024 07:28:41.355525970 CET | 303 | OUT | |
| Oct 27, 2024 07:28:41.690601110 CET | 298 | IN | |
| Oct 27, 2024 07:28:41.721812010 CET | 298 | IN | |
| Oct 27, 2024 07:28:43.902952909 CET | 303 | OUT | |
| Oct 27, 2024 07:28:44.033444881 CET | 298 | IN | |
| Oct 27, 2024 07:28:44.559974909 CET | 303 | OUT | |
| Oct 27, 2024 07:28:44.690581083 CET | 298 | IN | |
| Oct 27, 2024 07:28:50.794011116 CET | 303 | OUT | |
| Oct 27, 2024 07:28:50.924565077 CET | 298 | IN | |
| Oct 27, 2024 07:28:51.300422907 CET | 303 | OUT | |
| Oct 27, 2024 07:28:51.431063890 CET | 298 | IN | |
| Oct 27, 2024 07:28:51.464991093 CET | 303 | OUT | |
| Oct 27, 2024 07:28:51.595792055 CET | 298 | IN | |
| Oct 27, 2024 07:28:58.843609095 CET | 303 | OUT | |
| Oct 27, 2024 07:28:59.194645882 CET | 298 | IN | |
| Oct 27, 2024 07:29:09.203813076 CET | 6 | OUT | |
| Oct 27, 2024 07:29:12.750042915 CET | 303 | OUT | |
| Oct 27, 2024 07:29:12.881683111 CET | 298 | IN | |
| Oct 27, 2024 07:29:13.140010118 CET | 298 | IN | |
| Oct 27, 2024 07:29:20.709819078 CET | 303 | OUT | |
| Oct 27, 2024 07:29:20.840224981 CET | 298 | IN | |
| Oct 27, 2024 07:29:21.355086088 CET | 303 | OUT | |
| Oct 27, 2024 07:29:21.485666037 CET | 298 | IN | |
| Oct 27, 2024 07:29:31.489442110 CET | 6 | OUT | |
| Oct 27, 2024 07:29:41.518640995 CET | 6 | OUT | |
| Oct 27, 2024 07:29:51.547110081 CET | 6 | OUT | |
| Oct 27, 2024 07:29:53.382208109 CET | 303 | OUT | |
| Oct 27, 2024 07:29:53.512733936 CET | 298 | IN | |
| Oct 27, 2024 07:30:03.528141022 CET | 6 | OUT | |
| Oct 27, 2024 07:30:13.542253017 CET | 6 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49759 | 34.107.221.82 | 80 | 6784 | C:\Program Files\Mozilla Firefox\firefox.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Oct 27, 2024 07:28:32.604038000 CET | 305 | OUT | |
| Oct 27, 2024 07:28:33.205851078 CET | 216 | IN | |
| Oct 27, 2024 07:28:33.627523899 CET | 305 | OUT | |
| Oct 27, 2024 07:28:33.753709078 CET | 216 | IN | |
| Oct 27, 2024 07:28:38.988126993 CET | 305 | OUT | |
| Oct 27, 2024 07:28:39.114547968 CET | 216 | IN | |
| Oct 27, 2024 07:28:40.959562063 CET | 305 | OUT | |
| Oct 27, 2024 07:28:41.086287022 CET | 216 | IN | |
| Oct 27, 2024 07:28:42.463084936 CET | 305 | OUT | |
| Oct 27, 2024 07:28:42.589358091 CET | 216 | IN | |
| Oct 27, 2024 07:28:44.051327944 CET | 305 | OUT | |
| Oct 27, 2024 07:28:44.177887917 CET | 216 | IN | |
| Oct 27, 2024 07:28:44.693950891 CET | 305 | OUT | |
| Oct 27, 2024 07:28:44.820276976 CET | 216 | IN | |
| Oct 27, 2024 07:28:50.929570913 CET | 305 | OUT | |
| Oct 27, 2024 07:28:51.055958986 CET | 216 | IN | |
| Oct 27, 2024 07:28:51.434789896 CET | 305 | OUT | |
| Oct 27, 2024 07:28:51.561871052 CET | 216 | IN | |
| Oct 27, 2024 07:28:51.598958015 CET | 305 | OUT | |
| Oct 27, 2024 07:28:51.725107908 CET | 216 | IN | |
| Oct 27, 2024 07:28:59.198298931 CET | 305 | OUT | |
| Oct 27, 2024 07:28:59.325532913 CET | 216 | IN | |
| Oct 27, 2024 07:29:09.335377932 CET | 6 | OUT | |
| Oct 27, 2024 07:29:12.885284901 CET | 305 | OUT | |
| Oct 27, 2024 07:29:13.139952898 CET | 216 | IN | |
| Oct 27, 2024 07:29:20.897008896 CET | 305 | OUT | |
| Oct 27, 2024 07:29:21.023127079 CET | 216 | IN | |
| Oct 27, 2024 07:29:21.488802910 CET | 305 | OUT | |
| Oct 27, 2024 07:29:21.614976883 CET | 216 | IN | |
| Oct 27, 2024 07:29:31.620964050 CET | 6 | OUT | |
| Oct 27, 2024 07:29:41.634540081 CET | 6 | OUT | |
| Oct 27, 2024 07:29:51.647084951 CET | 6 | OUT | |
| Oct 27, 2024 07:29:53.518156052 CET | 305 | OUT | |
| Oct 27, 2024 07:29:53.644171000 CET | 216 | IN | |
| Oct 27, 2024 07:30:03.659699917 CET | 6 | OUT | |
| Oct 27, 2024 07:30:13.673917055 CET | 6 | OUT |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 02:28:12 |
| Start date: | 27/10/2024 |
| Path: | C:\Users\user\Desktop\XlKQ797V2E.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x740000 |
| File size: | 919'552 bytes |
| MD5 hash: | 8D1D2122C8A31716BAF394BB1E4C6F28 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 02:28:13 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\SysWOW64\taskkill.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf60000 |
| File size: | 74'240 bytes |
| MD5 hash: | CA313FD7E6C2A778FFD21CFB5C1C56CD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 02:28:13 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 02:28:15 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\SysWOW64\taskkill.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf60000 |
| File size: | 74'240 bytes |
| MD5 hash: | CA313FD7E6C2A778FFD21CFB5C1C56CD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 02:28:15 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\SysWOW64\taskkill.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf60000 |
| File size: | 74'240 bytes |
| MD5 hash: | CA313FD7E6C2A778FFD21CFB5C1C56CD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 7 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\SysWOW64\taskkill.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf60000 |
| File size: | 74'240 bytes |
| MD5 hash: | CA313FD7E6C2A778FFD21CFB5C1C56CD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\SysWOW64\taskkill.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf60000 |
| File size: | 74'240 bytes |
| MD5 hash: | CA313FD7E6C2A778FFD21CFB5C1C56CD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 10 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 11 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Program Files\Mozilla Firefox\firefox.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6bf500000 |
| File size: | 676'768 bytes |
| MD5 hash: | C86B1BE9ED6496FE0E0CBE73F81D8045 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 12 |
| Start time: | 02:28:16 |
| Start date: | 27/10/2024 |
| Path: | C:\Program Files\Mozilla Firefox\firefox.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6bf500000 |
| File size: | 676'768 bytes |
| MD5 hash: | C86B1BE9ED6496FE0E0CBE73F81D8045 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 13 |
| Start time: | 02:28:17 |
| Start date: | 27/10/2024 |
| Path: | C:\Program Files\Mozilla Firefox\firefox.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6bf500000 |
| File size: | 676'768 bytes |
| MD5 hash: | C86B1BE9ED6496FE0E0CBE73F81D8045 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
| Target ID: | 15 |
| Start time: | 02:28:18 |
| Start date: | 27/10/2024 |
| Path: | C:\Program Files\Mozilla Firefox\firefox.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6bf500000 |
| File size: | 676'768 bytes |
| MD5 hash: | C86B1BE9ED6496FE0E0CBE73F81D8045 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
| Target ID: | 16 |
| Start time: | 02:28:20 |
| Start date: | 27/10/2024 |
| Path: | C:\Program Files\Mozilla Firefox\firefox.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6bf500000 |
| File size: | 676'768 bytes |
| MD5 hash: | C86B1BE9ED6496FE0E0CBE73F81D8045 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
| Target ID: | 20 |
| Start time: | 02:28:39 |
| Start date: | 27/10/2024 |
| Path: | C:\Program Files\Mozilla Firefox\firefox.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6bf500000 |
| File size: | 676'768 bytes |
| MD5 hash: | C86B1BE9ED6496FE0E0CBE73F81D8045 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 2.1% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 4.6% |
| Total number of Nodes: | 1550 |
| Total number of Limit Nodes: | 48 |
Graph
Function 007442DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0074D730 Relevance: 21.6, APIs: 14, Instructions: 631sleepsynchronizationtimeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00742CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0078065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0074344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00742B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00743170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00743B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00743923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007410F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00743837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00744ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00778402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0076E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00774C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00773820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00744F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007430F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00742DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00742B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00741CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007BED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00748060 Relevance: 8.7, Strings: 6, Instructions: 1151COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0077BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0076CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0074CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007609D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0076781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00776DD9 Relevance: .6, Instructions: 637COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075CC39 Relevance: .6, Instructions: 635COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00747920 Relevance: .6, Instructions: 563COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007491C0 Relevance: .5, Instructions: 475COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00779EEE Relevance: .3, Instructions: 294COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00761C77 Relevance: .3, Instructions: 254COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00761F32 Relevance: .2, Instructions: 244COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007619B0 Relevance: .2, Instructions: 240COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00767A4A Relevance: .2, Instructions: 237COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00767CA7 Relevance: .2, Instructions: 237COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00761706 Relevance: .2, Instructions: 232COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B2046 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00758D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00758891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007CC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007BFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007BC476 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 143networkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0074326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007CB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007ABF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007CCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00758BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00759838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00778D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00772C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00745BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007BC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0077CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007ABC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007ADE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00781522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0077542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007ACF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007ADA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00745D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007701B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007761FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0079F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00797439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00764D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0079D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00744E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00744E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007CA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0077CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00759639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007722A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007595C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00770F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00775AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00778A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0077B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0077D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007ADF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00771D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0076D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0074600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00773073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007598B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0079D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0079D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007B4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0075F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007BD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007BCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007D2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 0.3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 100% |
| Total number of Nodes: | 6 |
| Total number of Limit Nodes: | 0 |
Graph
Callgraph
Function 000001DFBD0E41B2 Relevance: 26.1, APIs: 1, Strings: 10, Instructions: 6826nativeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|