Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1556229 |
| MD5: | a77b03795fd546e1ce17a89770416e0a |
| SHA1: | 6473da89e95a6750dfec775ec1805ec025b62ab5 |
| SHA256: | 47a3a02bf52254b5776960a68c2f17aa773cb66072843638b19cb582e6ef8409 |
| Tags: | exeSocks5Systemzuser-Bitsight |
| Infos: |  |
 | |
Detection
Socks5Systemz
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Socks5Systemz
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to infect the boot sector
Machine Learning detection for dropped file
PE file has a writeable .text section
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query network adapater information
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 4888 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: A77B03795FD546E1CE17A89770416E0A) - file.tmp (PID: 2316 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-OI7 16.tmp\fil e.tmp" /SL 5="$10448, 5263804,72 1408,C:\Us ers\user\D esktop\fil e.exe" MD5: 438F4076E92D3C839405BAB4652FE2CE) 
net.exe (PID: 6036 cmdline: "C:\Window s\system32 \net.exe" pause avid enta_11131 MD5: 31890A7DE89936F922D44D677F681A7F) 
conhost.exe (PID: 2916 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - net1.exe (PID: 2344 cmdline:
C:\Windows \system32\ net1 pause avidenta_ 11131 MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1) 
avidenta.exe (PID: 2008 cmdline: "C:\Users\ user\AppDa ta\Local\A videnta 2. 7.7\aviden ta.exe" -i MD5: 19F9733DCD58AFF930F87ACDAF4A09FB)
- cleanup
{"C2 list": ["bfpdiyt.com"]}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security | ||
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security | ||
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-15T07:01:00.242697+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:01.314768+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.515375+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.941518+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:05.993931+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49761 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.033028+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.453799+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.867193+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:08.919409+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:10.309793+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49789 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:11.386140+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49799 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.421187+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.838984+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:13.879662+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49812 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:14.942792+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49819 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:15.984449+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49827 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:17.037400+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49835 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:18.075398+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49841 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:19.117047+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49847 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:20.167044+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49854 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:21.205064+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49861 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:22.257797+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.297269+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.711052+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:25.785358+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49884 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:26.821369+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:27.885554+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:28.946667+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49908 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:29.993335+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49914 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.173329+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.591943+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:32.622953+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49930 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:33.652088+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49936 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:34.699887+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49941 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:35.764850+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:36.194262+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:37.246639+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49958 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:38.293787+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49964 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.346296+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.764461+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:40.192382+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:41.244018+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49984 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:42.289569+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49991 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:43.319445+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49998 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:44.356315+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50004 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:45.444830+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50010 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.488109+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.907019+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:47.989349+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50027 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:49.027877+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50033 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:50.067439+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50039 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:51.123442+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50044 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:52.159315+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50045 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:53.205252+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50046 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.251659+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.664781+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:55.710035+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50048 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:56.765029+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:57.197323+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:58.259279+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50050 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.297776+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.712387+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:00.762607+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50052 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:01.810741+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50053 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:02.934208+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50054 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:05.004821+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50055 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:06.057443+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50056 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:07.112714+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50057 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:08.165551+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50058 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:09.228737+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 50059 | 185.208.158.202 | 80 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-15T07:01:00.242697+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:01.314768+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.515375+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.941518+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:05.993931+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49761 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.033028+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.453799+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.867193+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:08.919409+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:10.309793+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49789 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:11.386140+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49799 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.421187+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.838984+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:13.879662+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49812 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:14.942792+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49819 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:15.984449+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49827 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:17.037400+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49835 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:18.075398+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49841 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:19.117047+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49847 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:20.167044+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49854 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:21.205064+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49861 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:22.257797+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.297269+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.711052+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:25.785358+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49884 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:26.821369+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:27.885554+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:28.946667+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49908 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:29.993335+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49914 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.173329+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.591943+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:32.622953+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49930 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:33.652088+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49936 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:34.699887+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49941 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:35.764850+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:36.194262+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:37.246639+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49958 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:38.293787+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49964 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.346296+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.764461+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:40.192382+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:41.244018+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49984 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:42.289569+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49991 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:43.319445+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49998 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:44.356315+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50004 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:45.444830+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50010 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.488109+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.907019+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:47.989349+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50027 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:49.027877+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50033 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:50.067439+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50039 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:51.123442+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50044 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:52.159315+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50045 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:53.205252+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50046 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.251659+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.664781+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:55.710035+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50048 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:56.765029+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:57.197323+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:58.259279+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50050 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.297776+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.712387+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:00.762607+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50052 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:01.810741+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50053 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:02.934208+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50054 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:05.004821+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50055 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:06.057443+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50056 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:07.112714+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50057 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:08.165551+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50058 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:09.228737+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 50059 | 185.208.158.202 | 80 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Code function: | 1_2_10001000 | |
| Source: | Code function: | 1_2_10001130 | |
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 4_2_02D772AB | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
System Summary | |
|---|
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 4_2_00401A4F | |
| Source: | Code function: | 4_2_00401051 | |
| Source: | Code function: | 4_2_00401C26 | |
| Source: | Code function: | 4_2_00406FB7 | |
| Source: | Code function: | 4_2_02DAB4E5 | |
| Source: | Code function: | 4_2_02D8E25D | |
| Source: | Code function: | 4_2_02D7F085 | |
| Source: | Code function: | 4_2_02D94EF9 | |
| Source: | Code function: | 4_2_02D92E84 | |
| Source: | Code function: | 4_2_02D8E675 | |
| Source: | Code function: | 4_2_02D89F54 | |
| Source: | Code function: | 4_2_02D8DD69 | |
| Source: | Code function: | 4_2_02D88512 | |
| Source: | Code function: | 4_2_02D8AD0A | |
| Source: | Dropped File: | ||
| Source: | Dropped File: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 4_2_02D808D0 | |
| Source: | Code function: | 4_2_0040D15E | |
| Source: | Code function: | 4_2_00401F64 | |
| Source: | Code function: | 4_2_0040D638 | |
| Source: | Code function: | 4_2_0040D638 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Window found: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Code function: | 4_2_00401B4B | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 4_2_004030DE | |
| Source: | Code function: | 4_2_0040B6D9 | |
| Source: | Code function: | 4_2_0040B6D9 | |
| Source: | Code function: | 4_2_02DE09B9 | |
| Source: | Code function: | 4_2_02DCAA4F | |
| Source: | Code function: | 4_2_02DCAA68 | |
| Source: | Code function: | 4_2_02DCAA6F | |
| Source: | Code function: | 4_2_02DE6A2B | |
| Source: | Code function: | 4_2_02DF8D84 | |
| Source: | Code function: | 4_2_02DF8D9E | |
| Source: | Code function: | 4_2_02DF8DDC | |
| Source: | Code function: | 4_2_02DAFAEC | |
| Source: | Code function: | 4_2_02DDF388 | |
| Source: | Code function: | 4_2_02D88C08 | |
| Source: | Code function: | 4_2_02D8688B | |
| Source: | Code function: | 4_2_02D86974 | |
| Source: | Code function: | 4_2_02D866B0 | |
| Source: | Code function: | 4_2_02D7EF9E | |
| Source: | Code function: | 4_2_02D9546B | |
| Source: | Code function: | 4_2_02D7546F | |
| Source: | Code function: | 4_2_02D9541E | |
| Source: | Code function: | 4_2_02D86597 | |
Persistence and Installation Behavior | |
|---|
| Source: | Code function: | 4_2_00401A4F | |
| Source: | Code function: | 4_2_02D7F8AE | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Code function: | 4_2_00401A4F | |
| Source: | Code function: | 4_2_02D7F8AE | |
| Source: | Code function: | 4_2_0040D638 | |
| Source: | Code function: | 4_2_02D88512 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Code function: | 4_2_00401B4B | |
| Source: | Code function: | 4_2_02D7F9B2 | |
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Evasive API call chain: | graph_4-19186 | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_4-19187 | ||
| Source: | API call chain: | graph_4-19900 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 4_2_02D901CE | |
| Source: | Code function: | 4_2_02D901CE | |
| Source: | Code function: | 4_2_00401B4B | |
| Source: | Code function: | 4_2_02D7648B | |
| Source: | Code function: | 4_2_02D89538 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 4_2_02D8807D | |
| Source: | Code function: | 4_2_00402283 | |
| Source: | Code function: | 1_2_10001000 | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | OS Credential Dumping | 1 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | 5 Windows Service | 5 Windows Service | 2 Obfuscated Files or Information | LSASS Memory | 23 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | 2 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 2 Service Execution | 1 Bootkit | 11 Process Injection | 2 Software Packing | Security Account Manager | 141 Security Software Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Standard Port | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | 1 Process Discovery | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Masquerading | LSA Secrets | 21 Virtualization/Sandbox Evasion | SSH | Keylogging | 112 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 21 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Application Window Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 11 Process Injection | DCSync | 2 System Owner/User Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 Bootkit | Proc Filesystem | 1 Remote System Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Network Configuration Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 29% | ReversingLabs | Win32.Trojan.Sockssystemz | ||
| 45% | Virustotal | Browse | ||
| 100% | Avira | HEUR/AGEN.1332534 |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML | |||
| 67% | ReversingLabs | Win32.PUA.ICLoader | ||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 67% | ReversingLabs | Win32.PUA.ICLoader | ||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bfpdiyt.com | 185.208.158.202 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 185.208.158.202 | bfpdiyt.com | Switzerland | 34888 | SIMPLECARRER2IT | true | |
| 89.105.201.183 | unknown | Netherlands | 24875 | NOVOSERVE-ASNL | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1556229 |
| Start date and time: | 2024-11-15 06:59:10 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 49s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@10/57@1/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target file.tmp, PID 2316 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtDeviceIoControlFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 01:00:39 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 185.208.158.202 | Get hash | malicious | Socks5Systemz | Browse | ||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| 89.105.201.183 | Get hash | malicious | Socks5Systemz | Browse |
| |
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SIMPLECARRER2IT | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Amadey | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Amadey | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| NOVOSERVE-ASNL | Get hash | malicious | Socks5Systemz | Browse |
| |
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Avidenta 2.7.7\CH375DLL.dll (copy) | Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT | Browse | ||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Babadeda SystemBC | Browse | |||
| C:\Users\user\AppData\Local\Avidenta 2.7.7\WinSparkle.dll (copy) | Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT | Browse | ||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Babadeda SystemBC | Browse |
| Process: | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8 |
| Entropy (8bit): | 2.0 |
| Encrypted: | false |
| SSDEEP: | 3:vTCl/ln:Li |
| MD5: | 8640A87AAC4CC7E20B871D0EA517D081 |
| SHA1: | B100F28CE5C69D162DE1D508260FCDB860077AF8 |
| SHA-256: | 609CC50CE12B3551600CC2B479BA888EAD7C1E4C9DBD7B013BF1BF2DA615F357 |
| SHA-512: | 0C6DF5A287D698EE9D55FDB362960837B3868DA847FA5B1A76D8835692BC5B0A54DEF78DFDEB1801ADB31733DF9973CA7C5360982E596CFCFD966781F686A710 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4 |
| Entropy (8bit): | 0.8112781244591328 |
| Encrypted: | false |
| SSDEEP: | 3:i:i |
| MD5: | EF0F409F0799E0546CBECC4A6C609AEF |
| SHA1: | CD5A8501E23DB0E06030E562829C372816F8E887 |
| SHA-256: | D23F96D836EBED25AD1D3D2B9D92362252CC8A347A98312A75284F7F6D08BD02 |
| SHA-512: | 6DC8AF620E1D800DD391FA8BF22FD7903776C26AF8C642C94F3F63C4DAEF1AF00F3B8C9FD050E86D2AFAFCBA864EC854C57A843EDA3E88B356DBD6CE743290A4 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 128 |
| Entropy (8bit): | 2.9545817380615236 |
| Encrypted: | false |
| SSDEEP: | 3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM |
| MD5: | 98DDA7FC0B3E548B68DE836D333D1539 |
| SHA1: | D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6 |
| SHA-256: | 870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D |
| SHA-512: | E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 128 |
| Entropy (8bit): | 1.7095628900165245 |
| Encrypted: | false |
| SSDEEP: | 3:LDXdQSWBdMUE/:LLdQSGd |
| MD5: | 4FFFD4D2A32CBF8FB78D521B4CC06680 |
| SHA1: | 3FA6EFA82F738740179A9388D8046619C7EBDF54 |
| SHA-256: | EC52F73A17E6AFCF78F3FD8DFC7177024FEB52F5AC2B602886788E4348D5FB68 |
| SHA-512: | 130A074E6AD38EEE2FB088BED2FCB939BF316B0FCBB4F5455AB49C2685BEEDCB5011107A22A153E56BF5E54A45CA4801C56936E71899C99BA9A4F694A1D4CC6D |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3698688 |
| Entropy (8bit): | 6.580367741040878 |
| Encrypted: | false |
| SSDEEP: | 49152:0nbWWMORoxCgL/hEYqncOW+F+wKbyUYa6Ql0G3bk7jsIJNU:cCB/hEYqncOW+F+WhvPnJN |
| MD5: | 19F9733DCD58AFF930F87ACDAF4A09FB |
| SHA1: | 4076EABD809CA63AB6619A9D85C8F5D686F89728 |
| SHA-256: | EF9C847985C1588A5D5F85ECAFDACE935D98C10AC9411E5C7040A7900A95FC43 |
| SHA-512: | 92BFC472EF3A965F6993163AA32E14273DE23061BED77125BD6D165A42FE39C83E2E07D33B86AD68F9893A0C347CAC7F063E667440422CC2E94EA45750ADECA8 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 15864 |
| Entropy (8bit): | 5.446150628226878 |
| Encrypted: | false |
| SSDEEP: | 384:zVQEjoZ7ooLzDCccymQx/9DSpNAJemtjf0Ncl08:zV1joxLH1SpKJtTF08 |
| MD5: | 43F2BC6828B177477C2F98B8973460E8 |
| SHA1: | F0A3C975346AF66A843E8B49574DC9083CD32E02 |
| SHA-256: | 3B578B15AD0D0747E8A3D958A0E7BF1FF6D5C335B8894FF7A020604DA008D79D |
| SHA-512: | 2449C3D615E5BCECE4C1B773FE629A75061A3E1488F6D3D743D7D209F1D687F26997937AB13B3A1B89B650D122DB030D2188E1E89BC1AB03CF2DF9A29CAA456C |
| Malicious: | true |
| Antivirus: |
|
| Joe Sandbox View: | |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 56223 |
| Entropy (8bit): | 7.675938408908281 |
| Encrypted: | false |
| SSDEEP: | 1536:/+jsHu4IMEuSznazX2TQZwm+WxhM6HMy6Z7:/ppIMEulGTuwmXhMwMB |
| MD5: | 619CA288DE840F0BEC52218DB7F2036C |
| SHA1: | D1D5389AAE91284734F4940BD8319CFA2BC40A0D |
| SHA-256: | C2A6D78B635CA45E316D10936EF7507B1643F4674BAA08B79FE22285EADC3966 |
| SHA-512: | 4FACBC40E37F9801E9177A057D55BF236C5FBCE5397AF973B60B21C027AB258FD1A91B893F93AE3100A6785AD67089FBF623C121B7D4990A987A311E47314E5C |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 132979 |
| Entropy (8bit): | 7.662743912764236 |
| Encrypted: | false |
| SSDEEP: | 3072:viQWV2mUue1Kkp5F8U4rpAzmYDbUabHidS42O9mR:vTWa91dFr4rpwnUTdF2O6 |
| MD5: | F88752DB58C53A82F2DCD5D11F8233AB |
| SHA1: | 6D41999B017AD74783339AD00E03811F48A60E97 |
| SHA-256: | 8B5AD9F2E46D3331989887761AFB6C3C7786BCA8D846444BF2FF234FD4E0E2DD |
| SHA-512: | 86350CC5DB773D092BFBDCB5710E90391ECE9D243E16706CD17E62197683520478FD32C2D4036DF45AF9326F59BF263A7FF7E56C662BEC5AA3960F6328852A00 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 543833 |
| Entropy (8bit): | 7.50496335178111 |
| Encrypted: | false |
| SSDEEP: | 6144:9DQ1236dLlSmlgZOw9/+wdM0zOyJromlIK1Z7HsH1GpYMnhdjYnDf67:dx6dLk/xSc+6sV8YIhdkDf67 |
| MD5: | 7D692438B7E70DE932BC386A3D44D319 |
| SHA1: | 5FC91DF8EA79A005A8583DCF44E0D48B7EC5A90F |
| SHA-256: | 05CB2D622DDEED62E052B8BBDB19DBE99B83F44F4447408601823B518D330586 |
| SHA-512: | 1A605B25724B91BE5802104BC8BAA0C4EB0A3638CFD84D8AECFF10FC41B72BFD44DDD8DA34373C1BB8B7C8D4823D222441E0CFAF9696B8F119F8BEA37ED9724D |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 81816 |
| Entropy (8bit): | 7.707519991934002 |
| Encrypted: | false |
| SSDEEP: | 1536:bsicsYedzR8eO9gKbvL2aiWqAIqwsoxlprW+DWu8UYHI7zoZ8jPy74RSBsZ:7p/dG9Bbz2DWqA1w7jKGWY3oujfRSBsZ |
| MD5: | 4C1F9B5ECF86DC7B839BF5D8F3ADFDC0 |
| SHA1: | CC6D1748BD0FFBB9036C0D871EC894E59B1CD6FC |
| SHA-256: | F2A2A3C04FB8E6E9467A62B408F705D77C9A4269B2ADF5EC1947A871A0D1C4F9 |
| SHA-512: | C49470EBA77A8616E7CE32CFE8DA98010635BDA0046BD8904328D11777162DE9774635F20627A772F24719DA3C7E217CDEB8A8ED41BBD71B04C722D6F0E217AB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66594 |
| Entropy (8bit): | 7.800838697373916 |
| Encrypted: | false |
| SSDEEP: | 1536:bOqndgG+IQ32TpUJz0DXmKTmg9usUFSZVl:bvQ3216zuXlFZVl |
| MD5: | DE2D8D73F85285535A13F89B0F904847 |
| SHA1: | A4A42EB9FA7F9C8A51CD24560D999163DEE57290 |
| SHA-256: | 306F7E5AFA1685939708DBBDAC6A0DD91DFE7C106BA6F84780BE9E44656B775B |
| SHA-512: | CD1E87D933E8E821769721A1B03E244655D519722329E114388FD5E18F4DA57DAA7D2E769379C4938BA8F958AA71A87FD1DA194967A57EF5B94AA3347ECB8D29 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Avidenta 2.7.7\Library\MichelleMyBelle Creations.scal (copy)
Download File
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 595545 |
| Entropy (8bit): | 7.0713050562667386 |
| Encrypted: | false |
| SSDEEP: | 12288:fTBZLFkAEYvIfNLmu2cTbZqSNTuh4kMjBUJ84Ch9ycd8sl:f7LgLF2cbZtNT+sjOJXCrgsl |
| MD5: | 3695D419AA9C7B11C464BE2A58A40530 |
| SHA1: | C73513DF0555DB421EF81EF436136E53CCF4EE11 |
| SHA-256: | 0487C6C64C185AC5BF459A907F302E363E5A162081B651570E691B3EA07818DD |
| SHA-512: | 54883F5E76E2208856F07DC16C9E5BCEA3ACBDA7C4B9CE48BF043CC371AD57F2925DCB6360CA85F5725609FC692906546B6E5BF70D8F839A206E06316C9E2F59 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 44241 |
| Entropy (8bit): | 7.747233988337866 |
| Encrypted: | false |
| SSDEEP: | 768:tZh3JPKW648iSo736Az5jwwcFuyZ3Y1Lnhe5xaLZPTAXogkA1sywv6:thPKz4/7h6fZ3Y1LhqxaB0Xrkosfv6 |
| MD5: | 561A63F0CD4A70F3134143A5E266E58D |
| SHA1: | 18F871AE3532B1F9A030EBF2EEE7AA7A4491D60C |
| SHA-256: | 7C1B0B11EBF37D03AE2F6CF5135593D604BC1D3BF942329A3952DC0CCB770769 |
| SHA-512: | 52F15AE1794120CA3E7E6204A4AEC9364BB8EBF7BF446753C53E8B5232BD7F76114603DABF41562318903EBEBB5390CDC4E651CDB33350AC5F3C0BDEDBBE3594 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 76044 |
| Entropy (8bit): | 7.781593198930996 |
| Encrypted: | false |
| SSDEEP: | 1536:9zCUsvuDmEm7KAaAJB2x56SPCwlkmsKpUaYVRMguAIXSA2:9z/s2Vm7KAajfl/sKpUaYVRM8YSf |
| MD5: | FA20A58E0C27D4DED87150AADDBB2556 |
| SHA1: | 74CF094D22A5806FD0DF01701851309CA3D3F263 |
| SHA-256: | A047FE59A6C64A6C17B887934245E64DAB2CDA4925B259456596C2C597740D75 |
| SHA-512: | 3E1C65AD1FB8728724FEFCB8601918BEABCFBF4DC31AE17BC5BAD66BFA32DB184950AC077B0B27AE399A4B3A6B5890AAB325805F4444CDF07C4D216B7FDA4EDD |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 92038 |
| Entropy (8bit): | 7.7200406826946235 |
| Encrypted: | false |
| SSDEEP: | 1536:ca4Jw4jmV7T35O0vMSndbJMZSMSU514ph64P8beNFbWmGINBU0Od:ca2bmh35rkmrU5f4P8beNhhG0rM |
| MD5: | E98226F38153CFBF93BF77744E364434 |
| SHA1: | 6E613678B12144ADAA5ADCC18AA40965EB903101 |
| SHA-256: | 825F3BA18ABDFA2164FBC1D183D8C1C178C9D99C3C4B694AC358D833A755D241 |
| SHA-512: | 228B1334D11F455EC6610DB53E36BCC2D747975EB5E8D650D41C92FD856A34E266ACE5A8A094FCE407E518EF76B6E0B00C983A0CDCE2B930B2222E16A4B6A5CD |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114158 |
| Entropy (8bit): | 7.754245071397085 |
| Encrypted: | false |
| SSDEEP: | 3072:o4KTAq4ntdBWZ4H9fCXCzTP0UuBkZcvqqUnj7K:ITCtzg4dCkgUuM1ju |
| MD5: | 1092617765A52BADA8A812FEA901B137 |
| SHA1: | 31DAA90CFE29AFA8E3FAAA10C049B45834833308 |
| SHA-256: | 88FF0A560A3DA375C323FD0C3761328419A06BA58E373EFB09F8418BC7EFF393 |
| SHA-512: | 37DA07F3DA44D298CED21FA3323B54CADC839F3C19ACE0FC000A614C0D8FAD833ABC06C6239C89D8FFAB465848FADB3E667D365DB8310286935705A118FBF901 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 132558 |
| Entropy (8bit): | 7.669771822889911 |
| Encrypted: | false |
| SSDEEP: | 3072:aqP0FOHIgQ/1E8d9ko/te/O+MFgriBmVdQIKgaKKHEZkiIZR1WjA/sBf:3P+Oogc1EyO8t4LMFgri0/3EPnIsEf |
| MD5: | E6497DA72921573C22D29C664B5C1EAA |
| SHA1: | 5D2F7BBC3E94BDCA08B9DABBE47CB4762024FCB8 |
| SHA-256: | 17BB9F3422F532DDFE5D6C9602E9E49BE765E4848ACA1C191CF0484B0092AB59 |
| SHA-512: | 1090C1B1D4005725DF62A20D8D4D68E0B561E7A285104CBD99F42E16A170A1BA8A2452F05162212D05683264104DEE3F504C90CE38033A393E92B62427397562 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 59279 |
| Entropy (8bit): | 7.723890349807642 |
| Encrypted: | false |
| SSDEEP: | 1536:WQSDmzHAmdxSMSfXUkfK9H3BpBZYtzWBiAmNHDm:W35mdxS2kfOHR1sqB8g |
| MD5: | A667A4635760A604F5E90455657DF9BA |
| SHA1: | 3ACEABEEDCFF9C6F7922FC954218D42D08B54A1F |
| SHA-256: | 196FD731971B11B3873D52EE13C1EFAC4BF9F0F91D82856CBBE05CA1FB659152 |
| SHA-512: | 3ABCFEC0BC6D820F4317A32B3E027B1CC3D4438825844618AEEF1443C8A0F9A059C1FAF36ACE16F6CD156260D74BC92BDC9EA489BE8F23B1FEA069D795E0B1E3 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 56822 |
| Entropy (8bit): | 7.651463699422176 |
| Encrypted: | false |
| SSDEEP: | 768:1ro+zsC5ugrZR+LeBc+m5IShs7ohcTvNg2xhMNdZ/aDIg2fbGw:pugrb+LeGvNukcTlg20V/anS1 |
| MD5: | 1FF0C9489E836499DB1ED7B3417BA478 |
| SHA1: | 750206AB4FBD34B17205ADF33710F91140323915 |
| SHA-256: | 74A96CB715FB81EB958BE3DFB60AF0C716D6CB0EF7DD1F5217CD15594DC3F39E |
| SHA-512: | 7EDE209919E3ECF80C47EBEC43207195AAC41C71F4C8398115AF2807EF07043A984086251C0A683A3F5F60AF51304D3559F9CC5385CE782FF5F6FA28B34F40B2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64537 |
| Entropy (8bit): | 7.783531894467484 |
| Encrypted: | false |
| SSDEEP: | 1536:mY9p0pAuZhUVKdEmHZt/YPBkBbnFeAHiix8qwQ1tTepK:m1EVmT/YpMT8qwQoK |
| MD5: | B877B821FAA0514BE7D67132C026D97B |
| SHA1: | B634758494358A2951799BDCDAA664271DFAD248 |
| SHA-256: | 32BC4297D594164F7BE3753FE2328132B0562C81C5EA18AC97831AE10C707F1B |
| SHA-512: | FD47CD1C73A83DAC589EE449D28BAC8E6AFE4D74BFBC077D670BF57A7BF141B7865BDE1F0C5179A7BC9569917ACD9967C6D173B7967442648E104F420C7A921F |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 211380 |
| Entropy (8bit): | 7.37236649718158 |
| Encrypted: | false |
| SSDEEP: | 3072:IOT3BfdrN6I+0ZQ/yYLtpAYVZy72KKkhaQ3iBbuRb4yVgwNefQd2Flx4wL0wT:1RFrN6I+02yf2KkJBOb4yVlefQ2FnT |
| MD5: | 5D5EAAC4FAA75CB7478198FEC28895CC |
| SHA1: | D7FC225DE85266FACABF314B166C957FF35EB122 |
| SHA-256: | 032B715FDE24B59BE882D379968C681AF09F0B15E9F42A9C55B8A668D78A36C7 |
| SHA-512: | DA90291D9022BADA837498A501DAC94414EE2B9A59724C7ADC656EDEA6FC8EAA060981B29ACFB92BC4BBFD358CAA6F379EB6C1B89510F2062E53B96A23888656 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 96301 |
| Entropy (8bit): | 7.809129886497833 |
| Encrypted: | false |
| SSDEEP: | 1536:dINDJFcDGljnsSvjgSyRFLcqIqE+yh319vpvKA9Z4CPOSLbnBKoIytnR2kJ7dm:iRcCBbv0SyRFByd3vFKCGSXBKTyLRdm |
| MD5: | E82C623CE1F741A9F4FDE9DC43F23630 |
| SHA1: | C2E84F76BFC81C1789AE7BB6AEE197E186774697 |
| SHA-256: | 05D668F5C491AA51C7DA93862D3E3C5843A27631BBD1C0EF8034B94080D6CE00 |
| SHA-512: | 6B51E4BE629BA85CA583A703700FD2CBFD43734BB29433BA4453CA068B767AB05B1F4084C71B22D6BF11D0B5CA73B9F4FF61A32436BA1A62CA465F1005847109 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 77426 |
| Entropy (8bit): | 7.644517291394499 |
| Encrypted: | false |
| SSDEEP: | 1536:3tRKxIbZjmpsrGj6q+RZFHMqxU9pSKi2RWscqh8Pi7Bs:3tR9bZycVlxzKnv78Pi7a |
| MD5: | 39DC4CE3E509EE530E2EC97E03E227D6 |
| SHA1: | E60B00E89197208BE2D9CF8F3C6C8661FBDEAED1 |
| SHA-256: | 5296290ACDD86B7DABEAFABC26D0EF6FDD1A8DD9EA2914F036B94D0AD115B973 |
| SHA-512: | 39711AE42F87C3E3B0E17A8378EFE05C416BA4D1895FF6F6E718B384D5C7699C318FF36CF420DCD480094EABCD9F07672ECB1FE3F4A3E64E8EF6C6450A010BD8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 77426 |
| Entropy (8bit): | 7.644517291394499 |
| Encrypted: | false |
| SSDEEP: | 1536:3tRKxIbZjmpsrGj6q+RZFHMqxU9pSKi2RWscqh8Pi7Bs:3tR9bZycVlxzKnv78Pi7a |
| MD5: | 39DC4CE3E509EE530E2EC97E03E227D6 |
| SHA1: | E60B00E89197208BE2D9CF8F3C6C8661FBDEAED1 |
| SHA-256: | 5296290ACDD86B7DABEAFABC26D0EF6FDD1A8DD9EA2914F036B94D0AD115B973 |
| SHA-512: | 39711AE42F87C3E3B0E17A8378EFE05C416BA4D1895FF6F6E718B384D5C7699C318FF36CF420DCD480094EABCD9F07672ECB1FE3F4A3E64E8EF6C6450A010BD8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66594 |
| Entropy (8bit): | 7.800838697373916 |
| Encrypted: | false |
| SSDEEP: | 1536:bOqndgG+IQ32TpUJz0DXmKTmg9usUFSZVl:bvQ3216zuXlFZVl |
| MD5: | DE2D8D73F85285535A13F89B0F904847 |
| SHA1: | A4A42EB9FA7F9C8A51CD24560D999163DEE57290 |
| SHA-256: | 306F7E5AFA1685939708DBBDAC6A0DD91DFE7C106BA6F84780BE9E44656B775B |
| SHA-512: | CD1E87D933E8E821769721A1B03E244655D519722329E114388FD5E18F4DA57DAA7D2E769379C4938BA8F958AA71A87FD1DA194967A57EF5B94AA3347ECB8D29 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 211380 |
| Entropy (8bit): | 7.37236649718158 |
| Encrypted: | false |
| SSDEEP: | 3072:IOT3BfdrN6I+0ZQ/yYLtpAYVZy72KKkhaQ3iBbuRb4yVgwNefQd2Flx4wL0wT:1RFrN6I+02yf2KkJBOb4yVlefQ2FnT |
| MD5: | 5D5EAAC4FAA75CB7478198FEC28895CC |
| SHA1: | D7FC225DE85266FACABF314B166C957FF35EB122 |
| SHA-256: | 032B715FDE24B59BE882D379968C681AF09F0B15E9F42A9C55B8A668D78A36C7 |
| SHA-512: | DA90291D9022BADA837498A501DAC94414EE2B9A59724C7ADC656EDEA6FC8EAA060981B29ACFB92BC4BBFD358CAA6F379EB6C1B89510F2062E53B96A23888656 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 76044 |
| Entropy (8bit): | 7.781593198930996 |
| Encrypted: | false |
| SSDEEP: | 1536:9zCUsvuDmEm7KAaAJB2x56SPCwlkmsKpUaYVRMguAIXSA2:9z/s2Vm7KAajfl/sKpUaYVRM8YSf |
| MD5: | FA20A58E0C27D4DED87150AADDBB2556 |
| SHA1: | 74CF094D22A5806FD0DF01701851309CA3D3F263 |
| SHA-256: | A047FE59A6C64A6C17B887934245E64DAB2CDA4925B259456596C2C597740D75 |
| SHA-512: | 3E1C65AD1FB8728724FEFCB8601918BEABCFBF4DC31AE17BC5BAD66BFA32DB184950AC077B0B27AE399A4B3A6B5890AAB325805F4444CDF07C4D216B7FDA4EDD |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 56822 |
| Entropy (8bit): | 7.651463699422176 |
| Encrypted: | false |
| SSDEEP: | 768:1ro+zsC5ugrZR+LeBc+m5IShs7ohcTvNg2xhMNdZ/aDIg2fbGw:pugrb+LeGvNukcTlg20V/anS1 |
| MD5: | 1FF0C9489E836499DB1ED7B3417BA478 |
| SHA1: | 750206AB4FBD34B17205ADF33710F91140323915 |
| SHA-256: | 74A96CB715FB81EB958BE3DFB60AF0C716D6CB0EF7DD1F5217CD15594DC3F39E |
| SHA-512: | 7EDE209919E3ECF80C47EBEC43207195AAC41C71F4C8398115AF2807EF07043A984086251C0A683A3F5F60AF51304D3559F9CC5385CE782FF5F6FA28B34F40B2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 132558 |
| Entropy (8bit): | 7.669771822889911 |
| Encrypted: | false |
| SSDEEP: | 3072:aqP0FOHIgQ/1E8d9ko/te/O+MFgriBmVdQIKgaKKHEZkiIZR1WjA/sBf:3P+Oogc1EyO8t4LMFgri0/3EPnIsEf |
| MD5: | E6497DA72921573C22D29C664B5C1EAA |
| SHA1: | 5D2F7BBC3E94BDCA08B9DABBE47CB4762024FCB8 |
| SHA-256: | 17BB9F3422F532DDFE5D6C9602E9E49BE765E4848ACA1C191CF0484B0092AB59 |
| SHA-512: | 1090C1B1D4005725DF62A20D8D4D68E0B561E7A285104CBD99F42E16A170A1BA8A2452F05162212D05683264104DEE3F504C90CE38033A393E92B62427397562 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 543833 |
| Entropy (8bit): | 7.50496335178111 |
| Encrypted: | false |
| SSDEEP: | 6144:9DQ1236dLlSmlgZOw9/+wdM0zOyJromlIK1Z7HsH1GpYMnhdjYnDf67:dx6dLk/xSc+6sV8YIhdkDf67 |
| MD5: | 7D692438B7E70DE932BC386A3D44D319 |
| SHA1: | 5FC91DF8EA79A005A8583DCF44E0D48B7EC5A90F |
| SHA-256: | 05CB2D622DDEED62E052B8BBDB19DBE99B83F44F4447408601823B518D330586 |
| SHA-512: | 1A605B25724B91BE5802104BC8BAA0C4EB0A3638CFD84D8AECFF10FC41B72BFD44DDD8DA34373C1BB8B7C8D4823D222441E0CFAF9696B8F119F8BEA37ED9724D |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 96301 |
| Entropy (8bit): | 7.809129886497833 |
| Encrypted: | false |
| SSDEEP: | 1536:dINDJFcDGljnsSvjgSyRFLcqIqE+yh319vpvKA9Z4CPOSLbnBKoIytnR2kJ7dm:iRcCBbv0SyRFByd3vFKCGSXBKTyLRdm |
| MD5: | E82C623CE1F741A9F4FDE9DC43F23630 |
| SHA1: | C2E84F76BFC81C1789AE7BB6AEE197E186774697 |
| SHA-256: | 05D668F5C491AA51C7DA93862D3E3C5843A27631BBD1C0EF8034B94080D6CE00 |
| SHA-512: | 6B51E4BE629BA85CA583A703700FD2CBFD43734BB29433BA4453CA068B767AB05B1F4084C71B22D6BF11D0B5CA73B9F4FF61A32436BA1A62CA465F1005847109 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 81816 |
| Entropy (8bit): | 7.707519991934002 |
| Encrypted: | false |
| SSDEEP: | 1536:bsicsYedzR8eO9gKbvL2aiWqAIqwsoxlprW+DWu8UYHI7zoZ8jPy74RSBsZ:7p/dG9Bbz2DWqA1w7jKGWY3oujfRSBsZ |
| MD5: | 4C1F9B5ECF86DC7B839BF5D8F3ADFDC0 |
| SHA1: | CC6D1748BD0FFBB9036C0D871EC894E59B1CD6FC |
| SHA-256: | F2A2A3C04FB8E6E9467A62B408F705D77C9A4269B2ADF5EC1947A871A0D1C4F9 |
| SHA-512: | C49470EBA77A8616E7CE32CFE8DA98010635BDA0046BD8904328D11777162DE9774635F20627A772F24719DA3C7E217CDEB8A8ED41BBD71B04C722D6F0E217AB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 595545 |
| Entropy (8bit): | 7.0713050562667386 |
| Encrypted: | false |
| SSDEEP: | 12288:fTBZLFkAEYvIfNLmu2cTbZqSNTuh4kMjBUJ84Ch9ycd8sl:f7LgLF2cbZtNT+sjOJXCrgsl |
| MD5: | 3695D419AA9C7B11C464BE2A58A40530 |
| SHA1: | C73513DF0555DB421EF81EF436136E53CCF4EE11 |
| SHA-256: | 0487C6C64C185AC5BF459A907F302E363E5A162081B651570E691B3EA07818DD |
| SHA-512: | 54883F5E76E2208856F07DC16C9E5BCEA3ACBDA7C4B9CE48BF043CC371AD57F2925DCB6360CA85F5725609FC692906546B6E5BF70D8F839A206E06316C9E2F59 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 92038 |
| Entropy (8bit): | 7.7200406826946235 |
| Encrypted: | false |
| SSDEEP: | 1536:ca4Jw4jmV7T35O0vMSndbJMZSMSU514ph64P8beNFbWmGINBU0Od:ca2bmh35rkmrU5f4P8beNhhG0rM |
| MD5: | E98226F38153CFBF93BF77744E364434 |
| SHA1: | 6E613678B12144ADAA5ADCC18AA40965EB903101 |
| SHA-256: | 825F3BA18ABDFA2164FBC1D183D8C1C178C9D99C3C4B694AC358D833A755D241 |
| SHA-512: | 228B1334D11F455EC6610DB53E36BCC2D747975EB5E8D650D41C92FD856A34E266ACE5A8A094FCE407E518EF76B6E0B00C983A0CDCE2B930B2222E16A4B6A5CD |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 132979 |
| Entropy (8bit): | 7.662743912764236 |
| Encrypted: | false |
| SSDEEP: | 3072:viQWV2mUue1Kkp5F8U4rpAzmYDbUabHidS42O9mR:vTWa91dFr4rpwnUTdF2O6 |
| MD5: | F88752DB58C53A82F2DCD5D11F8233AB |
| SHA1: | 6D41999B017AD74783339AD00E03811F48A60E97 |
| SHA-256: | 8B5AD9F2E46D3331989887761AFB6C3C7786BCA8D846444BF2FF234FD4E0E2DD |
| SHA-512: | 86350CC5DB773D092BFBDCB5710E90391ECE9D243E16706CD17E62197683520478FD32C2D4036DF45AF9326F59BF263A7FF7E56C662BEC5AA3960F6328852A00 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 44241 |
| Entropy (8bit): | 7.747233988337866 |
| Encrypted: | false |
| SSDEEP: | 768:tZh3JPKW648iSo736Az5jwwcFuyZ3Y1Lnhe5xaLZPTAXogkA1sywv6:thPKz4/7h6fZ3Y1LhqxaB0Xrkosfv6 |
| MD5: | 561A63F0CD4A70F3134143A5E266E58D |
| SHA1: | 18F871AE3532B1F9A030EBF2EEE7AA7A4491D60C |
| SHA-256: | 7C1B0B11EBF37D03AE2F6CF5135593D604BC1D3BF942329A3952DC0CCB770769 |
| SHA-512: | 52F15AE1794120CA3E7E6204A4AEC9364BB8EBF7BF446753C53E8B5232BD7F76114603DABF41562318903EBEBB5390CDC4E651CDB33350AC5F3C0BDEDBBE3594 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 59279 |
| Entropy (8bit): | 7.723890349807642 |
| Encrypted: | false |
| SSDEEP: | 1536:WQSDmzHAmdxSMSfXUkfK9H3BpBZYtzWBiAmNHDm:W35mdxS2kfOHR1sqB8g |
| MD5: | A667A4635760A604F5E90455657DF9BA |
| SHA1: | 3ACEABEEDCFF9C6F7922FC954218D42D08B54A1F |
| SHA-256: | 196FD731971B11B3873D52EE13C1EFAC4BF9F0F91D82856CBBE05CA1FB659152 |
| SHA-512: | 3ABCFEC0BC6D820F4317A32B3E027B1CC3D4438825844618AEEF1443C8A0F9A059C1FAF36ACE16F6CD156260D74BC92BDC9EA489BE8F23B1FEA069D795E0B1E3 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114158 |
| Entropy (8bit): | 7.754245071397085 |
| Encrypted: | false |
| SSDEEP: | 3072:o4KTAq4ntdBWZ4H9fCXCzTP0UuBkZcvqqUnj7K:ITCtzg4dCkgUuM1ju |
| MD5: | 1092617765A52BADA8A812FEA901B137 |
| SHA1: | 31DAA90CFE29AFA8E3FAAA10C049B45834833308 |
| SHA-256: | 88FF0A560A3DA375C323FD0C3761328419A06BA58E373EFB09F8418BC7EFF393 |
| SHA-512: | 37DA07F3DA44D298CED21FA3323B54CADC839F3C19ACE0FC000A614C0D8FAD833ABC06C6239C89D8FFAB465848FADB3E667D365DB8310286935705A118FBF901 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 56223 |
| Entropy (8bit): | 7.675938408908281 |
| Encrypted: | false |
| SSDEEP: | 1536:/+jsHu4IMEuSznazX2TQZwm+WxhM6HMy6Z7:/ppIMEulGTuwmXhMwMB |
| MD5: | 619CA288DE840F0BEC52218DB7F2036C |
| SHA1: | D1D5389AAE91284734F4940BD8319CFA2BC40A0D |
| SHA-256: | C2A6D78B635CA45E316D10936EF7507B1643F4674BAA08B79FE22285EADC3966 |
| SHA-512: | 4FACBC40E37F9801E9177A057D55BF236C5FBCE5397AF973B60B21C027AB258FD1A91B893F93AE3100A6785AD67089FBF623C121B7D4990A987A311E47314E5C |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64537 |
| Entropy (8bit): | 7.783531894467484 |
| Encrypted: | false |
| SSDEEP: | 1536:mY9p0pAuZhUVKdEmHZt/YPBkBbnFeAHiix8qwQ1tTepK:m1EVmT/YpMT8qwQoK |
| MD5: | B877B821FAA0514BE7D67132C026D97B |
| SHA1: | B634758494358A2951799BDCDAA664271DFAD248 |
| SHA-256: | 32BC4297D594164F7BE3753FE2328132B0562C81C5EA18AC97831AE10C707F1B |
| SHA-512: | FD47CD1C73A83DAC589EE449D28BAC8E6AFE4D74BFBC077D670BF57A7BF141B7865BDE1F0C5179A7BC9569917ACD9967C6D173B7967442648E104F420C7A921F |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1142272 |
| Entropy (8bit): | 6.575328533778386 |
| Encrypted: | false |
| SSDEEP: | 24576:JjNy0cphFIlPXI9RTczazoP2l0iS65WQ1jGb8JcBCu98xvtQ/U:JY0MhO+louaizR1jGb8iBCu98xvtQ/U |
| MD5: | 21CF2233F94BF81E22737E2CAE984FD1 |
| SHA1: | 428951E7391B7CFCA62624C11E24B361CAD9D2E0 |
| SHA-256: | FCB2DC122AD93E88AA07B99DB1292CF5B8F04F7F5125C7A9AD98E8790E0F7366 |
| SHA-512: | F033174BB79D1F0E9D23FBE983A5D5849AE7CC99BA52D7CB5480F55F25CDDAE0EADE184FBF7DF970DE39B6FA315A049A13234D8379C72DC5AE2E8DDBABA13772 |
| Malicious: | true |
| Antivirus: |
|
| Joe Sandbox View: | |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | modified |
| Size (bytes): | 3698688 |
| Entropy (8bit): | 6.580367741040878 |
| Encrypted: | false |
| SSDEEP: | 49152:0nbWWMORoxCgL/hEYqncOW+F+wKbyUYa6Ql0G3bk7jsIJNU:cCB/hEYqncOW+F+WhvPnJN |
| MD5: | 19F9733DCD58AFF930F87ACDAF4A09FB |
| SHA1: | 4076EABD809CA63AB6619A9D85C8F5D686F89728 |
| SHA-256: | EF9C847985C1588A5D5F85ECAFDACE935D98C10AC9411E5C7040A7900A95FC43 |
| SHA-512: | 92BFC472EF3A965F6993163AA32E14273DE23061BED77125BD6D165A42FE39C83E2E07D33B86AD68F9893A0C347CAC7F063E667440422CC2E94EA45750ADECA8 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1305600 |
| Entropy (8bit): | 6.804982979697153 |
| Encrypted: | false |
| SSDEEP: | 24576:emdh6XRecOlYMksUqYMSMvm+YNqwngZRa5R+joLzydTEfCSoIkNyi220BTpdAd:emdhnc3lgZRa7+jo6YR8eXBT3Ad |
| MD5: | 6330B1294C40518F7C6363F97338A0A9 |
| SHA1: | 350E07281719E55659F74884387FA072C0D53F52 |
| SHA-256: | 4D100667AD119AD52D1172173C97EB9EC30B7C378070DFD2D07A2A04767B4D86 |
| SHA-512: | 97E1D71881663496011E5B3D70E817D62EB39CD484CB091A633D6329BFF2900029B04D0086358A522C3BFDA187FC7AEBEEDACC16003FCD2937DF047A89D4E54F |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 348160 |
| Entropy (8bit): | 6.542655141037356 |
| Encrypted: | false |
| SSDEEP: | 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E |
| MD5: | 86F1895AE8C5E8B17D99ECE768A70732 |
| SHA1: | D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA |
| SHA-256: | 8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE |
| SHA-512: | 3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3698688 |
| Entropy (8bit): | 6.580367580387556 |
| Encrypted: | false |
| SSDEEP: | 49152:FnbWWMORoxCgL/hEYqncOW+F+wKbyUYa6Ql0G3bk7jsIJNU:tCB/hEYqncOW+F+WhvPnJN |
| MD5: | 9A8BF073B7F2EDCEB1B138E71650DDA2 |
| SHA1: | 0F1609BE226EAE061AE87C441B06579D93D0FD25 |
| SHA-256: | 36B98F0F8A6EDE516E7F1961B8488251FACFD91EF0DCC828E668D682B4328F9F |
| SHA-512: | 9A456E614D6B514115B02BD8B2E51A84F1597D84C77F3138F1876880974CFAD0A3FC577C3CCBDE8696BF1047C88436CC03A8DFF14E7C0BE1DC0CA8EB7E270E22 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1142272 |
| Entropy (8bit): | 6.575328533778386 |
| Encrypted: | false |
| SSDEEP: | 24576:JjNy0cphFIlPXI9RTczazoP2l0iS65WQ1jGb8JcBCu98xvtQ/U:JY0MhO+louaizR1jGb8iBCu98xvtQ/U |
| MD5: | 21CF2233F94BF81E22737E2CAE984FD1 |
| SHA1: | 428951E7391B7CFCA62624C11E24B361CAD9D2E0 |
| SHA-256: | FCB2DC122AD93E88AA07B99DB1292CF5B8F04F7F5125C7A9AD98E8790E0F7366 |
| SHA-512: | F033174BB79D1F0E9D23FBE983A5D5849AE7CC99BA52D7CB5480F55F25CDDAE0EADE184FBF7DF970DE39B6FA315A049A13234D8379C72DC5AE2E8DDBABA13772 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1305600 |
| Entropy (8bit): | 6.804982979697153 |
| Encrypted: | false |
| SSDEEP: | 24576:emdh6XRecOlYMksUqYMSMvm+YNqwngZRa5R+joLzydTEfCSoIkNyi220BTpdAd:emdhnc3lgZRa7+jo6YR8eXBT3Ad |
| MD5: | 6330B1294C40518F7C6363F97338A0A9 |
| SHA1: | 350E07281719E55659F74884387FA072C0D53F52 |
| SHA-256: | 4D100667AD119AD52D1172173C97EB9EC30B7C378070DFD2D07A2A04767B4D86 |
| SHA-512: | 97E1D71881663496011E5B3D70E817D62EB39CD484CB091A633D6329BFF2900029B04D0086358A522C3BFDA187FC7AEBEEDACC16003FCD2937DF047A89D4E54F |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 15864 |
| Entropy (8bit): | 5.446150628226878 |
| Encrypted: | false |
| SSDEEP: | 384:zVQEjoZ7ooLzDCccymQx/9DSpNAJemtjf0Ncl08:zV1joxLH1SpKJtTF08 |
| MD5: | 43F2BC6828B177477C2F98B8973460E8 |
| SHA1: | F0A3C975346AF66A843E8B49574DC9083CD32E02 |
| SHA-256: | 3B578B15AD0D0747E8A3D958A0E7BF1FF6D5C335B8894FF7A020604DA008D79D |
| SHA-512: | 2449C3D615E5BCECE4C1B773FE629A75061A3E1488F6D3D743D7D209F1D687F26997937AB13B3A1B89B650D122DB030D2188E1E89BC1AB03CF2DF9A29CAA456C |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 499712 |
| Entropy (8bit): | 6.414789978441117 |
| Encrypted: | false |
| SSDEEP: | 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e |
| MD5: | 561FA2ABB31DFA8FAB762145F81667C2 |
| SHA1: | C8CCB04EEDAC821A13FAE314A2435192860C72B8 |
| SHA-256: | DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B |
| SHA-512: | 7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 499712 |
| Entropy (8bit): | 6.414789978441117 |
| Encrypted: | false |
| SSDEEP: | 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e |
| MD5: | 561FA2ABB31DFA8FAB762145F81667C2 |
| SHA1: | C8CCB04EEDAC821A13FAE314A2435192860C72B8 |
| SHA-256: | DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B |
| SHA-512: | 7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 348160 |
| Entropy (8bit): | 6.542655141037356 |
| Encrypted: | false |
| SSDEEP: | 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E |
| MD5: | 86F1895AE8C5E8B17D99ECE768A70732 |
| SHA1: | D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA |
| SHA-256: | 8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE |
| SHA-512: | 3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2555217 |
| Entropy (8bit): | 6.364161494552352 |
| Encrypted: | false |
| SSDEEP: | 49152:gdrGT9oY0SAQ4+YI1Qb1oWGxblxZa0o8598j:gFGTv1QtGxHZabt |
| MD5: | 0F299B44F450181D8B1B058637377507 |
| SHA1: | 11CE62C7229B835C838167D8E0F2D9F41B54ADAE |
| SHA-256: | 7AC7A7FC3F6092670D8B6AD1AF251EF5D03335D57774E6B084ECCF28BBD680F7 |
| SHA-512: | FA664090B54FE4BBF139A3CCFCF1CB62027A683A8C008161827EDB292BFF252916112E73298A8D9A7176789404B08292ABA539265B98D8F0E130E794EDE49741 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 9235 |
| Entropy (8bit): | 3.849453080959928 |
| Encrypted: | false |
| SSDEEP: | 96:+O1qWm8OpYCntcTBf9JXzgYl0J76CRbcuJlED7MZAe2LH3RhE7DjM83UKqm2RetG:t1qWmzpYg8XKJ7rbP4DumHhY+JHv |
| MD5: | A16E003B935B7C1C048EAAAC1E643AD6 |
| SHA1: | E69E5118FBB1F9CAE30FB158A2AE2103385E480C |
| SHA-256: | A4A0AFD3E2A72CD3D24E228F5A81044A02A39E6B22046C3BCAD4D966149A977A |
| SHA-512: | 9AC673BD57D139302BBFAE9D6EA81F37C143F5B48D7C945DDF3A27374F45DC16B12373F3480C8EC32BB1F711C6C7FF51B581CE1DCF58059BF873C827005A67C8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2555217 |
| Entropy (8bit): | 6.364161494552352 |
| Encrypted: | false |
| SSDEEP: | 49152:gdrGT9oY0SAQ4+YI1Qb1oWGxblxZa0o8598j:gFGTv1QtGxHZabt |
| MD5: | 0F299B44F450181D8B1B058637377507 |
| SHA1: | 11CE62C7229B835C838167D8E0F2D9F41B54ADAE |
| SHA-256: | 7AC7A7FC3F6092670D8B6AD1AF251EF5D03335D57774E6B084ECCF28BBD680F7 |
| SHA-512: | FA664090B54FE4BBF139A3CCFCF1CB62027A683A8C008161827EDB292BFF252916112E73298A8D9A7176789404B08292ABA539265B98D8F0E130E794EDE49741 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2560 |
| Entropy (8bit): | 2.8818118453929262 |
| Encrypted: | false |
| SSDEEP: | 24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG |
| MD5: | A69559718AB506675E907FE49DEB71E9 |
| SHA1: | BC8F404FFDB1960B50C12FF9413C893B56F2E36F |
| SHA-256: | 2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC |
| SHA-512: | E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6144 |
| Entropy (8bit): | 4.720366600008286 |
| Encrypted: | false |
| SSDEEP: | 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0 |
| MD5: | E4211D6D009757C078A9FAC7FF4F03D4 |
| SHA1: | 019CD56BA687D39D12D4B13991C9A42EA6BA03DA |
| SHA-256: | 388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95 |
| SHA-512: | 17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2532352 |
| Entropy (8bit): | 6.380212187829063 |
| Encrypted: | false |
| SSDEEP: | 49152:IdrGT9oY0SAQ4+YI1Qb1oWGxblxZa0o8598:IFGTv1QtGxHZab |
| MD5: | 438F4076E92D3C839405BAB4652FE2CE |
| SHA1: | 046567CF90B9E87F4B3913030E1ACFC0A4341279 |
| SHA-256: | AD1772BD4F07C11A626DE2F257D2CC44B63FF9150BE9386512840A2381E97B7E |
| SHA-512: | 44985FE1773CC9D1A4EE5ED0E5BCAC058C0CD064D3A1E782D9C424EFEB89185528E19A177ECFAFA173B76B049301D5FF95DAFC0B36715A0847EEC3F6B4E1506B |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| File type: | |
| Entropy (8bit): | 7.942413186072027 |
| TrID: |
|
| File name: | file.exe |
| File size: | 5'964'353 bytes |
| MD5: | a77b03795fd546e1ce17a89770416e0a |
| SHA1: | 6473da89e95a6750dfec775ec1805ec025b62ab5 |
| SHA256: | 47a3a02bf52254b5776960a68c2f17aa773cb66072843638b19cb582e6ef8409 |
| SHA512: | b9ed6b713e84f78340ea76af9da0a987caa3cd67e58c071ff9f0c79d84e96996a37a3f6437a70eadedf6674e3e9f3d99a21eda71f5607f9dd833c3d937b480aa |
| SSDEEP: | 98304:PX41O2pXtg27SK59Ej2oVmV1J7bXc012r+z0nP7qT6D07uyazx11:viXu2159Ej2oUVf4r+AnP2TeyaR |
| TLSH: | 0E562227B298653EC4AE27354673A05068FBB76DE417BE1676E0C4CCCF260C11E3EA65 |
| File Content Preview: | MZP.....................@...............................................!..L.!..This program must be run under Win32..$7....................................................................................................................................... |
 | |
| Icon Hash: | 2d2e3797b32b2b99 |
| Entrypoint: | 0x4a7ed0 |
| Entrypoint Section: | .itext |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x5CC41133 [Sat Apr 27 08:22:11 2019 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | eb5bc6ff6263b364dfbfb78bdb48ed59 |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| add esp, FFFFFFA4h |
| push ebx |
| push esi |
| push edi |
| xor eax, eax |
| mov dword ptr [ebp-3Ch], eax |
| mov dword ptr [ebp-40h], eax |
| mov dword ptr [ebp-5Ch], eax |
| mov dword ptr [ebp-30h], eax |
| mov dword ptr [ebp-38h], eax |
| mov dword ptr [ebp-34h], eax |
| mov dword ptr [ebp-2Ch], eax |
| mov dword ptr [ebp-28h], eax |
| mov dword ptr [ebp-14h], eax |
| mov eax, 004A2BC0h |
| call 00007FF49059465Dh |
| xor eax, eax |
| push ebp |
| push 004A85C2h |
| push dword ptr fs:[eax] |
| mov dword ptr fs:[eax], esp |
| xor edx, edx |
| push ebp |
| push 004A857Eh |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| mov eax, dword ptr [004B0634h] |
| call 00007FF490628757h |
| call 00007FF4906282AEh |
| lea edx, dword ptr [ebp-14h] |
| xor eax, eax |
| call 00007FF4905A9C88h |
| mov edx, dword ptr [ebp-14h] |
| mov eax, 004B3708h |
| call 00007FF49058EEE7h |
| push 00000002h |
| push 00000000h |
| push 00000001h |
| mov ecx, dword ptr [004B3708h] |
| mov dl, 01h |
| mov eax, dword ptr [00423698h] |
| call 00007FF4905AACEFh |
| mov dword ptr [004B370Ch], eax |
| xor edx, edx |
| push ebp |
| push 004A852Ah |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| call 00007FF4906287DFh |
| mov dword ptr [004B3714h], eax |
| mov eax, dword ptr [004B3714h] |
| cmp dword ptr [eax+0Ch], 01h |
| jne 00007FF49062F09Ah |
| mov eax, dword ptr [004B3714h] |
| mov edx, 00000028h |
| call 00007FF4905AB5E4h |
| mov edx, dword ptr [004B3714h] |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0xb6000 | 0x9a | .edata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xb4000 | 0xf1c | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xb9000 | 0x4600 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xb8000 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0xb42e0 | 0x240 | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0xb5000 | 0x1a4 | .didata |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xa50e0 | 0xa5200 | d2d65fadb7b1be676e1248ab404382da | False | 0.3560172809424678 | data | 6.368250598681687 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .itext | 0xa7000 | 0x1668 | 0x1800 | 73e002411a8e0d309143a3e055e89568 | False | 0.5411783854166666 | data | 5.950488815097041 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .data | 0xa9000 | 0x37a4 | 0x3800 | 43e7b93b56ed2b1f2c341832da76e1f0 | False | 0.3604213169642857 | data | 5.027871318308703 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .bss | 0xad000 | 0x676c | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0xb4000 | 0xf1c | 0x1000 | daddecfdccd86a491d85012d9e547c63 | False | 0.36474609375 | data | 4.791610915860562 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .didata | 0xb5000 | 0x1a4 | 0x200 | be0581a07bd7d21a29f93f8752d3e826 | False | 0.345703125 | data | 2.7458225536678693 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .edata | 0xb6000 | 0x9a | 0x200 | 57cd71ca96fdc064696777e5b35cf0bb | False | 0.2578125 | data | 1.881069204504408 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .tls | 0xb7000 | 0x18 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0xb8000 | 0x5d | 0x200 | 967e84eb6ac477621cd1643650d7bc91 | False | 0.189453125 | data | 1.3697437648744617 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0xb9000 | 0x4600 | 0x4600 | fea5bb3fc2fa3b68503752c2bfab7c25 | False | 0.31986607142857143 | data | 4.434127232462732 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xb94c8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | Dutch | Netherlands | 0.5675675675675675 |
| RT_ICON | 0xb95f0 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 320 | Dutch | Netherlands | 0.4486994219653179 |
| RT_ICON | 0xb9b58 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 640 | Dutch | Netherlands | 0.4637096774193548 |
| RT_ICON | 0xb9e40 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1152 | Dutch | Netherlands | 0.3935018050541516 |
| RT_STRING | 0xba6e8 | 0x360 | data | 0.34375 | ||
| RT_STRING | 0xbaa48 | 0x260 | data | 0.3256578947368421 | ||
| RT_STRING | 0xbaca8 | 0x45c | data | 0.4068100358422939 | ||
| RT_STRING | 0xbb104 | 0x40c | data | 0.3754826254826255 | ||
| RT_STRING | 0xbb510 | 0x2d4 | data | 0.39226519337016574 | ||
| RT_STRING | 0xbb7e4 | 0xb8 | data | 0.6467391304347826 | ||
| RT_STRING | 0xbb89c | 0x9c | data | 0.6410256410256411 | ||
| RT_STRING | 0xbb938 | 0x374 | data | 0.4230769230769231 | ||
| RT_STRING | 0xbbcac | 0x398 | data | 0.3358695652173913 | ||
| RT_STRING | 0xbc044 | 0x368 | data | 0.3795871559633027 | ||
| RT_STRING | 0xbc3ac | 0x2a4 | data | 0.4275147928994083 | ||
| RT_RCDATA | 0xbc650 | 0x10 | data | 1.5 | ||
| RT_RCDATA | 0xbc660 | 0x2c4 | data | 0.6384180790960452 | ||
| RT_RCDATA | 0xbc924 | 0x2c | data | 1.1818181818181819 | ||
| RT_GROUP_ICON | 0xbc950 | 0x3e | data | English | United States | 0.8387096774193549 |
| RT_VERSION | 0xbc990 | 0x584 | data | English | United States | 0.24645892351274787 |
| RT_MANIFEST | 0xbcf14 | 0x62c | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.4240506329113924 |
| DLL | Import |
|---|---|
| kernel32.dll | GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale |
| comctl32.dll | InitCommonControls |
| version.dll | GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW |
| user32.dll | CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW |
| oleaut32.dll | SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate |
| netapi32.dll | NetWkstaGetInfo, NetApiBufferFree |
| advapi32.dll | RegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW |
| Name | Ordinal | Address |
|---|---|---|
| TMethodImplementationIntercept | 3 | 0x453abc |
| __dbk_fcall_wrapper | 2 | 0x40d3dc |
| dbkFCallWrapperAddr | 1 | 0x4b063c |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Dutch | Netherlands |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-15T07:01:00.242697+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:00.242697+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:01.314768+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:01.314768+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.515375+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.515375+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.941518+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:04.941518+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:05.993931+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49761 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:05.993931+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49761 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.033028+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.033028+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.453799+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.453799+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.867193+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:07.867193+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:08.919409+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:08.919409+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:10.309793+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49789 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:10.309793+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49789 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:11.386140+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49799 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:11.386140+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49799 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.421187+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.421187+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.838984+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:12.838984+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:13.879662+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49812 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:13.879662+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49812 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:14.942792+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49819 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:14.942792+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49819 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:15.984449+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49827 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:15.984449+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49827 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:17.037400+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49835 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:17.037400+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49835 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:18.075398+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49841 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:18.075398+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49841 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:19.117047+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49847 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:19.117047+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49847 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:20.167044+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49854 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:20.167044+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49854 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:21.205064+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49861 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:21.205064+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49861 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:22.257797+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:22.257797+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.297269+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.297269+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.711052+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:23.711052+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:25.785358+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49884 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:25.785358+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49884 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:26.821369+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:26.821369+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:27.885554+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:27.885554+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:28.946667+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49908 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:28.946667+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49908 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:29.993335+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49914 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:29.993335+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49914 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.173329+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.173329+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.591943+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:31.591943+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:32.622953+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49930 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:32.622953+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49930 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:33.652088+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49936 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:33.652088+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49936 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:34.699887+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49941 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:34.699887+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49941 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:35.764850+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:35.764850+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:36.194262+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:36.194262+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:37.246639+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49958 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:37.246639+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49958 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:38.293787+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49964 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:38.293787+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49964 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.346296+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.346296+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.764461+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:39.764461+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:40.192382+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:40.192382+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:41.244018+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49984 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:41.244018+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49984 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:42.289569+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49991 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:42.289569+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49991 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:43.319445+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49998 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:43.319445+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49998 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:44.356315+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50004 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:44.356315+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50004 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:45.444830+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50010 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:45.444830+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50010 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.488109+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.488109+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.907019+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:46.907019+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:47.989349+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50027 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:47.989349+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50027 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:49.027877+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50033 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:49.027877+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50033 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:50.067439+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50039 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:50.067439+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50039 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:51.123442+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50044 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:51.123442+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50044 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:52.159315+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50045 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:52.159315+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50045 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:53.205252+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50046 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:53.205252+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50046 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.251659+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.251659+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.664781+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:54.664781+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:55.710035+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50048 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:55.710035+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50048 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:56.765029+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:56.765029+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:57.197323+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:57.197323+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:58.259279+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50050 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:58.259279+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50050 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.297776+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.297776+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.712387+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:01:59.712387+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:00.762607+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50052 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:00.762607+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50052 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:01.810741+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50053 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:01.810741+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50053 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:02.934208+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50054 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:02.934208+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50054 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:05.004821+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50055 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:05.004821+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50055 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:06.057443+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50056 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:06.057443+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50056 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:07.112714+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50057 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:07.112714+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50057 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:08.165551+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50058 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:08.165551+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50058 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:09.228737+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 50059 | 185.208.158.202 | 80 | TCP |
| 2024-11-15T07:02:09.228737+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 50059 | 185.208.158.202 | 80 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 15, 2024 07:00:59.312336922 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:00:59.317687988 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:00:59.317790985 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:00:59.317913055 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:00:59.322866917 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:00.242629051 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:00.242697001 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:00.362348080 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:00.362828970 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:00.368228912 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:00.368273020 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:00.368294954 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:00.368321896 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:00.368493080 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:00.373567104 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:01.314703941 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:01.314768076 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:01.314795017 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:01.314836979 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:01.317828894 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:01.322921038 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:01.323105097 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:01.323105097 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:01.328141928 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:01.328481913 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:01.333365917 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:02.144404888 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:02.186367989 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:04.158134937 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:04.163640022 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:04.515218973 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:04.515374899 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:04.626791954 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:04.631793976 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:04.941447020 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:04.941518068 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:04.941555977 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:04.941603899 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:04.942625046 CET | 49760 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:04.947671890 CET | 2023 | 49760 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:04.947751999 CET | 49760 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:04.947802067 CET | 49760 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:04.947844028 CET | 49760 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:04.952661991 CET | 2023 | 49760 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:04.994647026 CET | 2023 | 49760 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:05.064316988 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:05.064605951 CET | 49761 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:05.069674015 CET | 80 | 49761 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:05.069753885 CET | 49761 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:05.069840908 CET | 49761 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:05.070121050 CET | 80 | 49739 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:05.070177078 CET | 49739 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:05.074778080 CET | 80 | 49761 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:05.566138029 CET | 2023 | 49760 | 89.105.201.183 | 192.168.2.4 |
| Nov 15, 2024 07:01:05.566319942 CET | 49760 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 15, 2024 07:01:05.993626118 CET | 80 | 49761 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:05.993931055 CET | 49761 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:06.112864971 CET | 49761 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:06.113199949 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:06.118284941 CET | 80 | 49761 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:06.118330956 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:06.118359089 CET | 49761 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:06.118524075 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:06.118524075 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:06.123584032 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.032819986 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.033027887 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.143413067 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.148951054 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.453727961 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.453799009 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.564229965 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.569255114 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.866877079 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.867192984 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.986272097 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.986522913 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.991530895 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.991609097 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.991682053 CET | 80 | 49772 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:07.991738081 CET | 49772 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.991812944 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:07.996685982 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:08.917296886 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:08.919409037 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:09.033260107 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:09.033623934 CET | 49789 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:09.038644075 CET | 80 | 49789 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:09.038789988 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:09.038885117 CET | 49789 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:09.038887978 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:09.039032936 CET | 49789 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:09.044105053 CET | 80 | 49789 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:10.309726000 CET | 80 | 49789 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:10.309792995 CET | 49789 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:10.425982952 CET | 49789 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:10.426310062 CET | 49799 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:10.431389093 CET | 80 | 49789 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:10.431425095 CET | 80 | 49799 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:10.431478024 CET | 49789 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:10.431533098 CET | 49799 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:10.431725979 CET | 49799 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:10.436583042 CET | 80 | 49799 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:11.385937929 CET | 80 | 49799 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:11.386140108 CET | 49799 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:11.503607035 CET | 49799 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:11.505141020 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:11.509059906 CET | 80 | 49799 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:11.509377003 CET | 49799 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:11.510227919 CET | 80 | 49805 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:11.510488033 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:11.510534048 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:11.515409946 CET | 80 | 49805 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:12.420936108 CET | 80 | 49805 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:12.421186924 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.533380032 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.538548946 CET | 80 | 49805 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:12.838709116 CET | 80 | 49805 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:12.838984013 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.959889889 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.960243940 CET | 49812 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.964962006 CET | 80 | 49805 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:12.965034962 CET | 80 | 49812 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:12.965042114 CET | 49805 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.965208054 CET | 49812 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.965369940 CET | 49812 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:12.970223904 CET | 80 | 49812 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:13.879401922 CET | 80 | 49812 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:13.879662037 CET | 49812 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:14.006426096 CET | 49812 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:14.006804943 CET | 49819 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:14.011657953 CET | 80 | 49819 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:14.011759043 CET | 49819 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:14.011883020 CET | 80 | 49812 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:14.011949062 CET | 49812 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:14.012077093 CET | 49819 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:14.016835928 CET | 80 | 49819 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:14.942650080 CET | 80 | 49819 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:14.942791939 CET | 49819 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:15.066843033 CET | 49819 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:15.067136049 CET | 49827 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:15.072091103 CET | 80 | 49819 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:15.072108030 CET | 80 | 49827 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:15.072171926 CET | 49819 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:15.072211981 CET | 49827 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:15.072390079 CET | 49827 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:15.077337980 CET | 80 | 49827 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:15.984363079 CET | 80 | 49827 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:15.984448910 CET | 49827 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:16.115367889 CET | 49827 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:16.115571976 CET | 49835 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:16.120579004 CET | 80 | 49835 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:16.120646954 CET | 49835 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:16.120791912 CET | 49835 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:16.120800018 CET | 80 | 49827 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:16.120857000 CET | 49827 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:16.125580072 CET | 80 | 49835 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:17.033782005 CET | 80 | 49835 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:17.037400007 CET | 49835 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:17.158149958 CET | 49835 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:17.158550978 CET | 49841 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:17.163477898 CET | 80 | 49835 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:17.163492918 CET | 80 | 49841 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:17.163569927 CET | 49835 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:17.163604021 CET | 49841 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:17.163736105 CET | 49841 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:17.168524027 CET | 80 | 49841 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:18.075282097 CET | 80 | 49841 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:18.075397968 CET | 49841 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:18.189580917 CET | 49841 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:18.189994097 CET | 49847 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:18.194844007 CET | 80 | 49847 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:18.194876909 CET | 80 | 49841 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:18.194926977 CET | 49847 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:18.194942951 CET | 49841 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:18.195103884 CET | 49847 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:18.199868917 CET | 80 | 49847 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:19.116764069 CET | 80 | 49847 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:19.117047071 CET | 49847 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:19.238012075 CET | 49847 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:19.238430023 CET | 49854 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:19.243659973 CET | 80 | 49847 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:19.243674040 CET | 80 | 49854 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:19.243705988 CET | 49847 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:19.243752956 CET | 49854 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:19.243911028 CET | 49854 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:19.248976946 CET | 80 | 49854 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:20.166889906 CET | 80 | 49854 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:20.167043924 CET | 49854 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:20.284514904 CET | 49854 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:20.284991980 CET | 49861 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:20.289868116 CET | 80 | 49861 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:20.289942026 CET | 49861 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:20.290060043 CET | 49861 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:20.290066957 CET | 80 | 49854 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:20.290127039 CET | 49854 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:20.294857025 CET | 80 | 49861 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:21.204813957 CET | 80 | 49861 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:21.205064058 CET | 49861 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:21.330341101 CET | 49861 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:21.330610037 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:21.335664988 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:21.336075068 CET | 80 | 49861 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:21.336163044 CET | 49861 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:21.336267948 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:21.336267948 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:21.341547012 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:22.257719040 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:22.257797003 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:22.378806114 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:22.378921032 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:22.384515047 CET | 80 | 49876 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:22.384927988 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:22.385016918 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:22.386336088 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:22.386769056 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:22.390367985 CET | 80 | 49876 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:23.297172070 CET | 80 | 49876 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:23.297269106 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.407911062 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.413198948 CET | 80 | 49876 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:23.710935116 CET | 80 | 49876 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:23.711051941 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.829766035 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.830117941 CET | 49884 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.835011005 CET | 80 | 49884 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:23.835086107 CET | 49884 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.835129976 CET | 80 | 49876 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:23.835190058 CET | 49876 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.835205078 CET | 49884 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:23.840156078 CET | 80 | 49884 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:25.783854961 CET | 80 | 49884 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:25.785357952 CET | 49884 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:25.907879114 CET | 49884 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:25.908407927 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:25.913058996 CET | 80 | 49884 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:25.913140059 CET | 49884 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:25.913275003 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:25.913345098 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:25.913464069 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:25.918405056 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:26.818639994 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:26.821368933 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:26.954898119 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:26.955182076 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:26.959976912 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:26.960011005 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:26.960025072 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:26.960077047 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:26.960268974 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:26.965065002 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:27.885405064 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:27.885554075 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:28.001272917 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:28.001583099 CET | 49908 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:28.007453918 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:28.007539034 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:28.007570028 CET | 80 | 49908 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:28.007648945 CET | 49908 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:28.007811069 CET | 49908 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:28.012691975 CET | 80 | 49908 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:28.946594000 CET | 80 | 49908 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:28.946666956 CET | 49908 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:29.068017006 CET | 49908 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:29.068408966 CET | 49914 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:29.073378086 CET | 80 | 49914 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:29.073462009 CET | 49914 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:29.073620081 CET | 49914 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:29.073637009 CET | 80 | 49908 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:29.073709965 CET | 49908 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:29.078587055 CET | 80 | 49914 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:29.993195057 CET | 80 | 49914 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:29.993335009 CET | 49914 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:30.110718012 CET | 49914 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:30.110975027 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:30.115858078 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:30.115873098 CET | 80 | 49914 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:30.115988970 CET | 49914 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:30.116003990 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:30.116169930 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:30.120901108 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:31.173060894 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:31.173329115 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.282895088 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.288429022 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:31.591784000 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:31.591943026 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.704857111 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.705142975 CET | 49930 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.710372925 CET | 80 | 49930 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:31.710488081 CET | 49930 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.710573912 CET | 49930 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.710674047 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:31.710844040 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:31.715790033 CET | 80 | 49930 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:32.622771978 CET | 80 | 49930 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:32.622952938 CET | 49930 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:32.736217022 CET | 49930 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:32.736447096 CET | 49936 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:32.741590977 CET | 80 | 49936 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:32.741630077 CET | 80 | 49930 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:32.741789103 CET | 49930 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:32.741800070 CET | 49936 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:32.742006063 CET | 49936 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:32.746933937 CET | 80 | 49936 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:33.652002096 CET | 80 | 49936 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:33.652087927 CET | 49936 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:33.767190933 CET | 49936 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:33.767447948 CET | 49941 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:33.772356987 CET | 80 | 49941 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:33.772583008 CET | 80 | 49936 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:33.772666931 CET | 49936 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:33.772677898 CET | 49941 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:33.772773027 CET | 49941 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:33.777712107 CET | 80 | 49941 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:34.699682951 CET | 80 | 49941 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:34.699887037 CET | 49941 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:34.816030025 CET | 49941 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:34.816468000 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:34.821548939 CET | 80 | 49941 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:34.821643114 CET | 80 | 49947 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:34.821671963 CET | 49941 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:34.821741104 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:34.821856022 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:34.826725006 CET | 80 | 49947 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:35.764760971 CET | 80 | 49947 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:35.764849901 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:35.878752947 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:35.883862019 CET | 80 | 49947 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:36.194041967 CET | 80 | 49947 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:36.194262028 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:36.317948103 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:36.318301916 CET | 49958 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:36.323447943 CET | 80 | 49947 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:36.323468924 CET | 80 | 49958 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:36.323522091 CET | 49947 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:36.323542118 CET | 49958 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:36.323637962 CET | 49958 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:36.328735113 CET | 80 | 49958 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:37.246402025 CET | 80 | 49958 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:37.246639013 CET | 49958 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:37.363277912 CET | 49958 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:37.363697052 CET | 49964 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:37.368801117 CET | 80 | 49964 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:37.368879080 CET | 80 | 49958 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:37.368892908 CET | 49964 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:37.368936062 CET | 49958 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:37.369119883 CET | 49964 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:37.374259949 CET | 80 | 49964 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:38.293673992 CET | 80 | 49964 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:38.293787003 CET | 49964 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:38.414902925 CET | 49964 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:38.415225029 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:38.420325994 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:38.420387030 CET | 80 | 49964 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:38.420480967 CET | 49964 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:38.420485973 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:38.420732021 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:38.425822020 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:39.346205950 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:39.346296072 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:39.455725908 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:39.460886002 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:39.764125109 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:39.764461040 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:39.878618956 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:39.884485960 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:40.192281961 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:40.192382097 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:40.314392090 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:40.314563036 CET | 49984 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:40.319801092 CET | 80 | 49984 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:40.319881916 CET | 49984 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:40.319967985 CET | 80 | 49970 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:40.320005894 CET | 49984 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:40.320041895 CET | 49970 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:40.325614929 CET | 80 | 49984 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:41.243911982 CET | 80 | 49984 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:41.244018078 CET | 49984 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:41.361191988 CET | 49984 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:41.361459017 CET | 49991 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:41.366460085 CET | 80 | 49991 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:41.366547108 CET | 49991 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:41.366641998 CET | 80 | 49984 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:41.366698980 CET | 49984 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:41.366789103 CET | 49991 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:41.371686935 CET | 80 | 49991 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:42.289401054 CET | 80 | 49991 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:42.289568901 CET | 49991 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:42.408842087 CET | 49991 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:42.409096003 CET | 49998 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:42.414001942 CET | 80 | 49998 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:42.414091110 CET | 49998 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:42.414132118 CET | 80 | 49991 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:42.414194107 CET | 49991 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:42.414232016 CET | 49998 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:42.419049025 CET | 80 | 49998 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:43.319232941 CET | 80 | 49998 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:43.319444895 CET | 49998 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:43.439671040 CET | 49998 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:43.440013885 CET | 50004 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:43.445054054 CET | 80 | 50004 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:43.445142984 CET | 50004 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:43.445245028 CET | 50004 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:43.445302963 CET | 80 | 49998 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:43.445421934 CET | 49998 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:43.450189114 CET | 80 | 50004 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:44.356075048 CET | 80 | 50004 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:44.356314898 CET | 50004 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:44.514261961 CET | 50004 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:44.514673948 CET | 50010 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:44.519632101 CET | 80 | 50010 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:44.519701004 CET | 50010 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:44.520018101 CET | 80 | 50004 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:44.520091057 CET | 50004 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:44.533196926 CET | 50010 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:44.539000034 CET | 80 | 50010 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:45.444763899 CET | 80 | 50010 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:45.444829941 CET | 50010 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:45.563982010 CET | 50010 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:45.564330101 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:45.569509029 CET | 80 | 50017 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:45.569547892 CET | 80 | 50010 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:45.569612026 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:45.569626093 CET | 50010 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:45.569770098 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:45.574712992 CET | 80 | 50017 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:46.488028049 CET | 80 | 50017 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:46.488109112 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:46.597596884 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:46.602790117 CET | 80 | 50017 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:46.906776905 CET | 80 | 50017 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:46.907018900 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:47.065088987 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:47.067169905 CET | 50027 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:47.071209908 CET | 80 | 50017 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:47.071362019 CET | 50017 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:47.072376966 CET | 80 | 50027 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:47.072446108 CET | 50027 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:47.074882984 CET | 50027 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:47.079893112 CET | 80 | 50027 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:47.988614082 CET | 80 | 50027 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:47.989348888 CET | 50027 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:48.110965014 CET | 50027 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:48.111465931 CET | 50033 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:48.116811037 CET | 80 | 50033 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:48.116894960 CET | 80 | 50027 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:48.117001057 CET | 50027 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:48.117243052 CET | 50033 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:48.117243052 CET | 50033 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:48.122212887 CET | 80 | 50033 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:49.027813911 CET | 80 | 50033 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:49.027877092 CET | 50033 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:49.142940044 CET | 50033 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:49.143403053 CET | 50039 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:49.148164988 CET | 80 | 50033 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:49.148225069 CET | 50033 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:49.148320913 CET | 80 | 50039 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:49.148386002 CET | 50039 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:49.148497105 CET | 50039 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:49.153386116 CET | 80 | 50039 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:50.065282106 CET | 80 | 50039 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:50.067439079 CET | 50039 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:50.191400051 CET | 50039 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:50.191859007 CET | 50044 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:50.196585894 CET | 80 | 50039 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:50.196749926 CET | 50039 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:50.196875095 CET | 80 | 50044 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:50.196963072 CET | 50044 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:50.197166920 CET | 50044 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:50.201992989 CET | 80 | 50044 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:51.119915009 CET | 80 | 50044 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:51.123441935 CET | 50044 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:51.237987041 CET | 50044 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:51.238265991 CET | 50045 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:51.243887901 CET | 80 | 50045 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:51.243930101 CET | 80 | 50044 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:51.244453907 CET | 50045 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:51.244453907 CET | 50045 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:51.244468927 CET | 50044 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:51.249958038 CET | 80 | 50045 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:52.159041882 CET | 80 | 50045 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:52.159315109 CET | 50045 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:52.284784079 CET | 50045 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:52.285137892 CET | 50046 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:52.290792942 CET | 80 | 50046 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:52.290883064 CET | 80 | 50045 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:52.291078091 CET | 50046 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:52.291258097 CET | 50045 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:52.291364908 CET | 50046 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:52.297018051 CET | 80 | 50046 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:53.205014944 CET | 80 | 50046 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:53.205251932 CET | 50046 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:53.333064079 CET | 50046 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:53.333796978 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:53.338722944 CET | 80 | 50046 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:53.338845015 CET | 80 | 50047 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:53.338857889 CET | 50046 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:53.338941097 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:53.339104891 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:53.343982935 CET | 80 | 50047 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:54.251362085 CET | 80 | 50047 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:54.251658916 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.360786915 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.366226912 CET | 80 | 50047 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:54.664494038 CET | 80 | 50047 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:54.664781094 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.782644033 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.782773972 CET | 50048 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.788135052 CET | 80 | 50048 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:54.788223982 CET | 80 | 50047 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:54.788352013 CET | 50048 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.788398981 CET | 50047 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.788441896 CET | 50048 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:54.793868065 CET | 80 | 50048 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:55.709806919 CET | 80 | 50048 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:55.710035086 CET | 50048 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:55.829802990 CET | 50048 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:55.829952955 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:55.835015059 CET | 80 | 50049 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:55.835098982 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:55.835232973 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:55.835268974 CET | 80 | 50048 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:55.835340977 CET | 50048 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:55.840236902 CET | 80 | 50049 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:56.764612913 CET | 80 | 50049 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:56.765028954 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:56.876621008 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:56.882117987 CET | 80 | 50049 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:57.197213888 CET | 80 | 50049 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:57.197323084 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:57.316751003 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:57.317044020 CET | 50050 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:57.322242975 CET | 80 | 50050 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:57.322499037 CET | 50050 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:57.322499037 CET | 50050 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:57.322730064 CET | 80 | 50049 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:57.322904110 CET | 50049 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:57.329986095 CET | 80 | 50050 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:58.259193897 CET | 80 | 50050 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:58.259279013 CET | 50050 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:58.378839016 CET | 50050 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:58.379092932 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:58.384291887 CET | 80 | 50051 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:58.384501934 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:58.384501934 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:58.388670921 CET | 80 | 50050 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:58.388828039 CET | 50050 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:58.389784098 CET | 80 | 50051 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:59.297656059 CET | 80 | 50051 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:59.297775984 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.409075022 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.414340973 CET | 80 | 50051 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:59.712176085 CET | 80 | 50051 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:59.712387085 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.829870939 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.830661058 CET | 50052 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.835973978 CET | 80 | 50051 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:59.836065054 CET | 80 | 50052 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:01:59.836102009 CET | 50051 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.836146116 CET | 50052 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.836256981 CET | 50052 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:01:59.841787100 CET | 80 | 50052 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:00.762412071 CET | 80 | 50052 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:00.762607098 CET | 50052 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:00.876707077 CET | 50052 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:00.877021074 CET | 50053 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:00.884413004 CET | 80 | 50052 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:00.884458065 CET | 80 | 50053 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:00.884592056 CET | 50052 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:00.884754896 CET | 50053 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:00.884824991 CET | 50053 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:00.892841101 CET | 80 | 50053 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:01.810648918 CET | 80 | 50053 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:01.810740948 CET | 50053 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:01.988281965 CET | 50053 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:01.988564968 CET | 50054 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:01.993647099 CET | 80 | 50054 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:01.993733883 CET | 50054 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:01.993936062 CET | 80 | 50053 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:01.994009018 CET | 50053 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:01.996484995 CET | 50054 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:02.001828909 CET | 80 | 50054 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:02.934076071 CET | 80 | 50054 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:02.934207916 CET | 50054 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:03.050251007 CET | 50054 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:03.050522089 CET | 50055 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:03.055526018 CET | 80 | 50055 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:03.055612087 CET | 50055 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:03.055696011 CET | 50055 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:03.055798054 CET | 80 | 50054 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:03.055855989 CET | 50054 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:03.060575962 CET | 80 | 50055 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:05.004724979 CET | 80 | 50055 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:05.004821062 CET | 50055 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:05.129148960 CET | 50055 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:05.129472017 CET | 50056 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:05.134675980 CET | 80 | 50056 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:05.134715080 CET | 80 | 50055 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:05.134759903 CET | 50056 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:05.134778023 CET | 50055 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:05.135001898 CET | 50056 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:05.139936924 CET | 80 | 50056 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:06.055915117 CET | 80 | 50056 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:06.057442904 CET | 50056 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:06.190936089 CET | 50056 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:06.191370964 CET | 50057 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:06.196516991 CET | 80 | 50057 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:06.196636915 CET | 80 | 50056 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:06.199418068 CET | 50057 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:06.199419975 CET | 50056 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:06.199523926 CET | 50057 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:06.204418898 CET | 80 | 50057 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:07.112466097 CET | 80 | 50057 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:07.112714052 CET | 50057 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:07.226011038 CET | 50057 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:07.226552010 CET | 50058 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:07.231482029 CET | 80 | 50057 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:07.231532097 CET | 50057 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:07.232081890 CET | 80 | 50058 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:07.232146978 CET | 50058 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:07.232342005 CET | 50058 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:07.237153053 CET | 80 | 50058 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:08.162482023 CET | 80 | 50058 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:08.165550947 CET | 50058 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:08.301651955 CET | 50058 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:08.301872015 CET | 50059 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:08.306813002 CET | 80 | 50059 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:08.307053089 CET | 80 | 50058 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:08.307147026 CET | 50059 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:08.307158947 CET | 50058 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:08.307300091 CET | 50059 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 15, 2024 07:02:08.312135935 CET | 80 | 50059 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:09.228636026 CET | 80 | 50059 | 185.208.158.202 | 192.168.2.4 |
| Nov 15, 2024 07:02:09.228737116 CET | 50059 | 80 | 192.168.2.4 | 185.208.158.202 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 15, 2024 07:00:59.216675997 CET | 64749 | 53 | 192.168.2.4 | 45.155.250.90 |
| Nov 15, 2024 07:00:59.251557112 CET | 53 | 64749 | 45.155.250.90 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Nov 15, 2024 07:00:59.216675997 CET | 192.168.2.4 | 45.155.250.90 | 0x26cf | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 15, 2024 07:00:59.251557112 CET | 45.155.250.90 | 192.168.2.4 | 0x26cf | No error (0) | 185.208.158.202 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:00:59.317913055 CET | 314 | OUT | |
| Nov 15, 2024 07:01:00.242629051 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49739 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:00.368493080 CET | 314 | OUT | |
| Nov 15, 2024 07:01:01.314703941 CET | 1236 | IN | |
| Nov 15, 2024 07:01:01.314795017 CET | 170 | IN | |
| Nov 15, 2024 07:01:04.158134937 CET | 322 | OUT | |
| Nov 15, 2024 07:01:04.515218973 CET | 220 | IN | |
| Nov 15, 2024 07:01:04.626791954 CET | 322 | OUT | |
| Nov 15, 2024 07:01:04.941447020 CET | 1236 | IN | |
| Nov 15, 2024 07:01:04.941555977 CET | 26 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49761 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:05.069840908 CET | 322 | OUT | |
| Nov 15, 2024 07:01:05.993626118 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49772 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:06.118524075 CET | 322 | OUT | |
| Nov 15, 2024 07:01:07.032819986 CET | 220 | IN | |
| Nov 15, 2024 07:01:07.143413067 CET | 322 | OUT | |
| Nov 15, 2024 07:01:07.453727961 CET | 220 | IN | |
| Nov 15, 2024 07:01:07.564229965 CET | 322 | OUT | |
| Nov 15, 2024 07:01:07.866877079 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:07.991812944 CET | 322 | OUT | |
| Nov 15, 2024 07:01:08.917296886 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49789 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:09.039032936 CET | 322 | OUT | |
| Nov 15, 2024 07:01:10.309726000 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49799 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:10.431725979 CET | 322 | OUT | |
| Nov 15, 2024 07:01:11.385937929 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49805 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:11.510534048 CET | 322 | OUT | |
| Nov 15, 2024 07:01:12.420936108 CET | 220 | IN | |
| Nov 15, 2024 07:01:12.533380032 CET | 322 | OUT | |
| Nov 15, 2024 07:01:12.838709116 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49812 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:12.965369940 CET | 322 | OUT | |
| Nov 15, 2024 07:01:13.879401922 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49819 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:14.012077093 CET | 322 | OUT | |
| Nov 15, 2024 07:01:14.942650080 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49827 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:15.072390079 CET | 322 | OUT | |
| Nov 15, 2024 07:01:15.984363079 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.4 | 49835 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:16.120791912 CET | 322 | OUT | |
| Nov 15, 2024 07:01:17.033782005 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.4 | 49841 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:17.163736105 CET | 322 | OUT | |
| Nov 15, 2024 07:01:18.075282097 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.4 | 49847 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:18.195103884 CET | 322 | OUT | |
| Nov 15, 2024 07:01:19.116764069 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.4 | 49854 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:19.243911028 CET | 322 | OUT | |
| Nov 15, 2024 07:01:20.166889906 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.4 | 49861 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:20.290060043 CET | 322 | OUT | |
| Nov 15, 2024 07:01:21.204813957 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:21.336267948 CET | 322 | OUT | |
| Nov 15, 2024 07:01:22.257719040 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.4 | 49876 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:22.385016918 CET | 322 | OUT | |
| Nov 15, 2024 07:01:23.297172070 CET | 220 | IN | |
| Nov 15, 2024 07:01:23.407911062 CET | 322 | OUT | |
| Nov 15, 2024 07:01:23.710935116 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.4 | 49884 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:23.835205078 CET | 322 | OUT | |
| Nov 15, 2024 07:01:25.783854961 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:25.913464069 CET | 322 | OUT | |
| Nov 15, 2024 07:01:26.818639994 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:26.960268974 CET | 322 | OUT | |
| Nov 15, 2024 07:01:27.885405064 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.4 | 49908 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:28.007811069 CET | 322 | OUT | |
| Nov 15, 2024 07:01:28.946594000 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.4 | 49914 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:29.073620081 CET | 322 | OUT | |
| Nov 15, 2024 07:01:29.993195057 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:30.116169930 CET | 322 | OUT | |
| Nov 15, 2024 07:01:31.173060894 CET | 220 | IN | |
| Nov 15, 2024 07:01:31.282895088 CET | 322 | OUT | |
| Nov 15, 2024 07:01:31.591784000 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.4 | 49930 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:31.710573912 CET | 322 | OUT | |
| Nov 15, 2024 07:01:32.622771978 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.4 | 49936 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:32.742006063 CET | 322 | OUT | |
| Nov 15, 2024 07:01:33.652002096 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.4 | 49941 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:33.772773027 CET | 322 | OUT | |
| Nov 15, 2024 07:01:34.699682951 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 27 | 192.168.2.4 | 49947 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:34.821856022 CET | 322 | OUT | |
| Nov 15, 2024 07:01:35.764760971 CET | 220 | IN | |
| Nov 15, 2024 07:01:35.878752947 CET | 322 | OUT | |
| Nov 15, 2024 07:01:36.194041967 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 28 | 192.168.2.4 | 49958 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:36.323637962 CET | 322 | OUT | |
| Nov 15, 2024 07:01:37.246402025 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 29 | 192.168.2.4 | 49964 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:37.369119883 CET | 322 | OUT | |
| Nov 15, 2024 07:01:38.293673992 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 30 | 192.168.2.4 | 49970 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:38.420732021 CET | 322 | OUT | |
| Nov 15, 2024 07:01:39.346205950 CET | 220 | IN | |
| Nov 15, 2024 07:01:39.455725908 CET | 322 | OUT | |
| Nov 15, 2024 07:01:39.764125109 CET | 220 | IN | |
| Nov 15, 2024 07:01:39.878618956 CET | 322 | OUT | |
| Nov 15, 2024 07:01:40.192281961 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 31 | 192.168.2.4 | 49984 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:40.320005894 CET | 322 | OUT | |
| Nov 15, 2024 07:01:41.243911982 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 32 | 192.168.2.4 | 49991 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:41.366789103 CET | 322 | OUT | |
| Nov 15, 2024 07:01:42.289401054 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 33 | 192.168.2.4 | 49998 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:42.414232016 CET | 322 | OUT | |
| Nov 15, 2024 07:01:43.319232941 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 34 | 192.168.2.4 | 50004 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:43.445245028 CET | 322 | OUT | |
| Nov 15, 2024 07:01:44.356075048 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 35 | 192.168.2.4 | 50010 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:44.533196926 CET | 322 | OUT | |
| Nov 15, 2024 07:01:45.444763899 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 36 | 192.168.2.4 | 50017 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:45.569770098 CET | 322 | OUT | |
| Nov 15, 2024 07:01:46.488028049 CET | 220 | IN | |
| Nov 15, 2024 07:01:46.597596884 CET | 322 | OUT | |
| Nov 15, 2024 07:01:46.906776905 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 37 | 192.168.2.4 | 50027 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:47.074882984 CET | 322 | OUT | |
| Nov 15, 2024 07:01:47.988614082 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 38 | 192.168.2.4 | 50033 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:48.117243052 CET | 322 | OUT | |
| Nov 15, 2024 07:01:49.027813911 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 39 | 192.168.2.4 | 50039 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:49.148497105 CET | 322 | OUT | |
| Nov 15, 2024 07:01:50.065282106 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 40 | 192.168.2.4 | 50044 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:50.197166920 CET | 322 | OUT | |
| Nov 15, 2024 07:01:51.119915009 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 41 | 192.168.2.4 | 50045 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:51.244453907 CET | 322 | OUT | |
| Nov 15, 2024 07:01:52.159041882 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 42 | 192.168.2.4 | 50046 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:52.291364908 CET | 322 | OUT | |
| Nov 15, 2024 07:01:53.205014944 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 43 | 192.168.2.4 | 50047 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:53.339104891 CET | 322 | OUT | |
| Nov 15, 2024 07:01:54.251362085 CET | 220 | IN | |
| Nov 15, 2024 07:01:54.360786915 CET | 322 | OUT | |
| Nov 15, 2024 07:01:54.664494038 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 44 | 192.168.2.4 | 50048 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:54.788441896 CET | 322 | OUT | |
| Nov 15, 2024 07:01:55.709806919 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 45 | 192.168.2.4 | 50049 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:55.835232973 CET | 322 | OUT | |
| Nov 15, 2024 07:01:56.764612913 CET | 220 | IN | |
| Nov 15, 2024 07:01:56.876621008 CET | 322 | OUT | |
| Nov 15, 2024 07:01:57.197213888 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 46 | 192.168.2.4 | 50050 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:57.322499037 CET | 322 | OUT | |
| Nov 15, 2024 07:01:58.259193897 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 47 | 192.168.2.4 | 50051 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:58.384501934 CET | 322 | OUT | |
| Nov 15, 2024 07:01:59.297656059 CET | 220 | IN | |
| Nov 15, 2024 07:01:59.409075022 CET | 322 | OUT | |
| Nov 15, 2024 07:01:59.712176085 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 48 | 192.168.2.4 | 50052 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:01:59.836256981 CET | 322 | OUT | |
| Nov 15, 2024 07:02:00.762412071 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 49 | 192.168.2.4 | 50053 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:02:00.884824991 CET | 322 | OUT | |
| Nov 15, 2024 07:02:01.810648918 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 50 | 192.168.2.4 | 50054 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:02:01.996484995 CET | 322 | OUT | |
| Nov 15, 2024 07:02:02.934076071 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 51 | 192.168.2.4 | 50055 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:02:03.055696011 CET | 322 | OUT | |
| Nov 15, 2024 07:02:05.004724979 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 52 | 192.168.2.4 | 50056 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:02:05.135001898 CET | 322 | OUT | |
| Nov 15, 2024 07:02:06.055915117 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 53 | 192.168.2.4 | 50057 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:02:06.199523926 CET | 322 | OUT | |
| Nov 15, 2024 07:02:07.112466097 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 54 | 192.168.2.4 | 50058 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:02:07.232342005 CET | 322 | OUT | |
| Nov 15, 2024 07:02:08.162482023 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 55 | 192.168.2.4 | 50059 | 185.208.158.202 | 80 | 2008 | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 15, 2024 07:02:08.307300091 CET | 322 | OUT | |
| Nov 15, 2024 07:02:09.228636026 CET | 220 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 01:00:02 |
| Start date: | 15/11/2024 |
| Path: | C:\Users\user\Desktop\file.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 5'964'353 bytes |
| MD5 hash: | A77B03795FD546E1CE17A89770416E0A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 01:00:03 |
| Start date: | 15/11/2024 |
| Path: | C:\Users\user\AppData\Local\Temp\is-OI716.tmp\file.tmp |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 2'532'352 bytes |
| MD5 hash: | 438F4076E92D3C839405BAB4652FE2CE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 2 |
| Start time: | 01:00:05 |
| Start date: | 15/11/2024 |
| Path: | C:\Windows\SysWOW64\net.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf0000 |
| File size: | 47'104 bytes |
| MD5 hash: | 31890A7DE89936F922D44D677F681A7F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 01:00:05 |
| Start date: | 15/11/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 01:00:05 |
| Start date: | 15/11/2024 |
| Path: | C:\Users\user\AppData\Local\Avidenta 2.7.7\avidenta.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'698'688 bytes |
| MD5 hash: | 19F9733DCD58AFF930F87ACDAF4A09FB |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 5 |
| Start time: | 01:00:05 |
| Start date: | 15/11/2024 |
| Path: | C:\Windows\SysWOW64\net1.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4f0000 |
| File size: | 139'776 bytes |
| MD5 hash: | 2EFE6ED4C294AB8A39EB59C80813FEC1 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Function 10001130 Relevance: .1, Instructions: 55COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 10001000 Relevance: .0, Instructions: 2COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 9.9% |
| Dynamic/Decrypted Code Coverage: | 83.9% |
| Signature Coverage: | 5.1% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 45 |
Graph
Function 02D772AB Relevance: 74.2, APIs: 29, Strings: 13, Instructions: 659networksleepfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D7648B Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 228memorysleeplibraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D7F9B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D7F8AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D71CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105synchronizationCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D74D86 Relevance: 16.8, APIs: 11, Instructions: 256COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D726DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92timeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D77B98 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D77BB1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 149sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D72B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D729EE Relevance: 7.6, APIs: 5, Instructions: 79networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D71BA7 Relevance: 7.6, APIs: 5, Instructions: 75COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00403220 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D72EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D72DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D72AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D7353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D7369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82100 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D71AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004026F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402AA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D74BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D72D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004025F0 Relevance: 3.0, APIs: 2, Instructions: 39libraryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D783F5 Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004025BD Relevance: 3.0, APIs: 2, Instructions: 31libraryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404364 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D75119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02DAFAC5 Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D7E9CC Relevance: 1.6, APIs: 1, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02DAF9E6 Relevance: 1.6, APIs: 1, Instructions: 62fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D733B2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02DAFB30 Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DF8D68 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DAFA44 Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DAF872 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D7E55C Relevance: 1.5, APIs: 1, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D7E33B Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DB5C7E Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D24A Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D83F Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402AC3 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D82170 Relevance: 1.3, APIs: 1, Instructions: 43COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004022DB Relevance: 1.3, APIs: 1, Instructions: 20stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402AEC Relevance: 1.3, APIs: 1, Instructions: 9sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D735 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406FB7 Relevance: 26.7, Strings: 21, Instructions: 417COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D808D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040D638 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 19timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D15E Relevance: 1.5, APIs: 1, Instructions: 12serviceCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401051 Relevance: .8, Instructions: 774COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D7F085 Relevance: .6, Instructions: 634COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D8E675 Relevance: .3, Instructions: 331COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D8E25D Relevance: .3, Instructions: 323COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401C26 Relevance: .3, Instructions: 263COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DAB4E5 Relevance: .0, Instructions: 13COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D724E1 Relevance: 21.2, APIs: 14, Instructions: 173COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004023B3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 75registrysynchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D73423 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004068E8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406BC7 Relevance: 13.7, APIs: 9, Instructions: 177COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004045CD Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403F12 Relevance: 12.1, APIs: 8, Instructions: 132COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D81620 Relevance: 10.6, APIs: 7, Instructions: 132COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D72081 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D81732 Relevance: 10.6, APIs: 7, Instructions: 107synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D85DA4 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D834D1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D835A6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D95690 Relevance: 9.3, APIs: 6, Instructions: 276COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406A7E Relevance: 9.1, APIs: 6, Instructions: 117COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D71C91 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationthreadinjectionCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D81940 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D74030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404044 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D7E103 Relevance: 7.6, APIs: 5, Instructions: 92COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D721D5 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D72298 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D72420 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D71EC7 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D730AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D83B5C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004034CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404F8C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D837BD Relevance: 6.1, APIs: 4, Instructions: 136COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D73D7E Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D7239D Relevance: 6.1, APIs: 4, Instructions: 52COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D7247D Relevance: 6.0, APIs: 4, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D72004 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D71E26 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D79674 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D719C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404DE0 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|