Edit tour
Windows
Analysis Report
AwMu7gR48D.exe
Overview
General Information
| Sample name: | AwMu7gR48D.exerenamed because original name is a hash value |
| Original sample name: | 6f4acfdbac861233f66afa46e67b349354826d039a367314f28f13fd7bfa5287.exe |
| Analysis ID: | 1567521 |
| MD5: | e910dd39a106dfb09f31945608899357 |
| SHA1: | 3c769e1093522daf75c7425413a5d44dd3f29f7f |
| SHA256: | 6f4acfdbac861233f66afa46e67b349354826d039a367314f28f13fd7bfa5287 |
| Tags: | exeGuLoaderuser-adrian__luca |
| Infos: |   |
 | |
Detection
GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Early bird code injection technique detected
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected GuLoader
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Powershell drops PE file
Queues an APC in another process (thread injection)
Suspicious powershell command line found
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
AwMu7gR48D.exe (PID: 1992 cmdline: "C:\Users\ user\Deskt op\AwMu7gR 48D.exe" MD5: E910DD39A106DFB09F31945608899357) 
powershell.exe (PID: 6076 cmdline: "powershel l.exe" -wi ndowstyle hidden "$K valitetssa nsens=Get- Content -r aw 'C:\Use rs\user\Ap pData\Loca l\unshabbi ly\Tagkamr ets.Pan';$ Elbowy=$Kv alitetssan sens.SubSt ring(54196 ,3);.$Elbo wy($Kvalit etssansens )" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 5684 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
msiexec.exe (PID: 4516 cmdline: "C:\Window s\SysWOW64 \msiexec.e xe" MD5: 9D09DC1EDA745A5F87553048E57620CF)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security |
System Summary |   |
|---|
| Source: | Author: frack113: | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-03T16:43:50.010223+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.9 | 49709 | 172.217.19.174 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_00406232 | |
| Source: | Code function: | 0_2_004056F7 | |
| Source: | Code function: | 0_2_004026F8 | |
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00405194 | |
System Summary | |
|---|
| Source: | File created: | Jump to dropped file | ||
| Source: | Code function: | 0_2_004031BB | |
| Source: | Code function: | 0_2_004049D3 | |
| Source: | Code function: | 0_2_004065BB | |
| Source: | Dropped File: | ||
| Source: | Dropped File: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004031BB | |
| Source: | Code function: | 0_2_00404460 | |
| Source: | Code function: | 0_2_004020CB | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 2_2_0758FA63 | |
| Source: | Code function: | 2_2_0758F01E | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00406232 | |
| Source: | Code function: | 0_2_004056F7 | |
| Source: | Code function: | 0_2_004026F8 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-3602 | ||
| Source: | API call chain: | graph_0-3606 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Code function: | 2_2_0758D55C | |
| Source: | Process token adjusted: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Thread APC queued: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_004031BB | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Access Token Manipulation | 1 Masquerading | OS Credential Dumping | 111 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 2 PowerShell | Boot or Logon Initialization Scripts | 311 Process Injection | 31 Virtualization/Sandbox Evasion | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | 1 Clipboard Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Access Token Manipulation | Security Account Manager | 31 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 311 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | 3 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Software Packing | Cached Domain Credentials | 14 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 58% | ReversingLabs | Win32.Spyware.Snakekeylogger | ||
| 100% | Avira | TR/Injector.qhjhe |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | TR/Injector.qhjhe | ||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 58% | ReversingLabs | Win32.Spyware.Snakekeylogger |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 172.217.19.174 | true | false | high | |
| drive.usercontent.google.com | 142.250.181.1 | true | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.181.1 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.19.174 | drive.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1567521 |
| Start date and time: | 2024-12-03 16:41:57 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 31s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | AwMu7gR48D.exerenamed because original name is a hash value |
| Original Sample Name: | 6f4acfdbac861233f66afa46e67b349354826d039a367314f28f13fd7bfa5287.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@6/14@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target powershell.exe, PID 6076 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- VT rate limit hit for: AwMu7gR48D.exe
| Time | Type | Description |
|---|---|---|
| 10:43:01 | API Interceptor | |
| 10:43:51 | API Interceptor |
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader | Browse |
| |
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | DarkCloud | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 14744 |
| Entropy (8bit): | 4.992175361088568 |
| Encrypted: | false |
| SSDEEP: | 384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA |
| MD5: | A35685B2B980F4BD3C6FD278EA661412 |
| SHA1: | 59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062 |
| SHA-256: | 3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930 |
| SHA-512: | 70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4096 |
| Entropy (8bit): | 3.6614996787412575 |
| Encrypted: | false |
| SSDEEP: | 48:qYGZ0Gtq/oaPybCQ1hsIqXA1AfsgsfbLwGXwaEvRugYy/ImBmrm:wDAoyXAykgEUGAaGRuRm |
| MD5: | 245AC30568C8703531FC4E64B321BE16 |
| SHA1: | BADD01A31FC2B8CC050A1DC3489FC8F620C450F7 |
| SHA-256: | B91763928CE210BFC0A43B0AC1178D68CB95CFAD68439B25B55A53B7AA53B207 |
| SHA-512: | 9A81F2DE2CC41F6E35498B04B6327ADCFF268523F7B6A9EA9D5CFA1B2CF0425E59A121C99F0A0251C3380886CC058E88DE8A12B17E049D5FD5D7EEB0C956F083 |
| Malicious: | true |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4096 |
| Entropy (8bit): | 3.286321681873388 |
| Encrypted: | false |
| SSDEEP: | 48:qK64n2rZ4vuXXqQr1wH+zL/o0o/X/3MVyjlZSC15gaoFU:5P4ZxKQruHkJwvcVyV4FU |
| MD5: | 200E4D67E7A08D4C92F05E31442095FE |
| SHA1: | 1D0492FDFB7C0C8799AEA7982DA8B4EFEDE7581B |
| SHA-256: | 01D867E3A1F0AEC39A4FF02FE9FAFEFC78D6A12390A0DA8ECBF4E7DA5379E42E |
| SHA-512: | 620AB7A94E4EE965C159CC1A5F2ADC2CC6616CFB738EA191EAB404B249D21DD19134A314A21315F4EE2C0A75FD5062D1BF353BB75B877A61171F27F4A87CF995 |
| Malicious: | true |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 500524 |
| Entropy (8bit): | 7.632562248014631 |
| Encrypted: | false |
| SSDEEP: | 12288:SpC1NSIUW2qjUT8IiMGQb7jYF+Xg0x1Odt3xD:eC1UabQb2+XPMV |
| MD5: | E910DD39A106DFB09F31945608899357 |
| SHA1: | 3C769E1093522DAF75C7425413A5D44DD3F29F7F |
| SHA-256: | 6F4ACFDBAC861233F66AFA46E67B349354826D039A367314F28F13FD7BFA5287 |
| SHA-512: | EE160A5DF59B154AD96DCF11862098A09D0502C8C7C78DF2484A3CBD93DA21C9A2EA4A79DA3800AC38544B3217889F55D877CC70B86F71B43E87C9DCE9125170 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 134563 |
| Entropy (8bit): | 1.2420304589895552 |
| Encrypted: | false |
| SSDEEP: | 768:JTXI/LYa4cD2ujQzIsqIoMEJ8owrALEXMFrDwh0aHlC++KDTvfO/Ky:EnVS+r9brkwN/ |
| MD5: | E6066CC79780E021C55CDC3EF8FC82CC |
| SHA1: | FADDF02F672BEA8C3A766FB42F1FDC365934ED50 |
| SHA-256: | ED56062F4EA903C040602E4F50BB0F88A5E5DAC8F9F50A608D0495347C1003B8 |
| SHA-512: | 1F856CE5664BA5BC3914ACE73BDF0F0EBD419A5162890F9E7F66A9878DA9ACDDE9E24A42DDCE4ADAC7014F41F4C54977D9754DC867A9570B6A7BCAB757FC53F7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 347357 |
| Entropy (8bit): | 1.2510537828861161 |
| Encrypted: | false |
| SSDEEP: | 768:7wNmQThgiCB7GJHZUFVJPaSenNvSIpJjRuermO9c3NMRzgJrawa1+VWzoIk33SnI:Agcs7GTR7EvgE |
| MD5: | 10C53FA2ADD5E04A7C257241470F8B30 |
| SHA1: | F280F7414C749DA2A84EAC4DF1AD18B623325CF8 |
| SHA-256: | E27733521BB45F4719C1FFFB5D0D9262E8BAA510C52E7EC880612464E5889685 |
| SHA-512: | CF23EA9FB2316C67A1AAA7DCEFD48728F9DBC17E2413867EBFEB443F2EE7CF0BCFCF00F2FAF094A56779FEAE27D14E7408D629E0DF4EF7A8D2CF4FAFA1EBF2D0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4242 |
| Entropy (8bit): | 1.1689000520156396 |
| Encrypted: | false |
| SSDEEP: | 24:3X9EQjC0f2xlR8XA8f+6mqZVN//sTqYiegGDXMTTO1zlvyQ:nbpexne/+UfNXsNiSCTOPvh |
| MD5: | 7F09DBB1E7A421C1C43B98C594A1F1EE |
| SHA1: | 5E541763EFD79D7005668B908BE438412E042CBD |
| SHA-256: | 20F7314F0A64579C20FFBAC8DE67F9D36FD4824F5C64DC01D89F5FF4908BCDC5 |
| SHA-512: | B901933CD173EDC42828FCC6CCA5B4A4BC29FD0F0ADD0AE08BE56BBF1D24781C542C8CE99142069287C976F6E8059D5ACD95FEA8D54427D9B02F74765352AAF5 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 300506 |
| Entropy (8bit): | 7.692220351018027 |
| Encrypted: | false |
| SSDEEP: | 6144:zZvgBKxTIdbvFjs3a9xjEKBfFMGUpDLVYdXpzDLzwJbv:1MyIdbvFjAaZd4pdYd5rEz |
| MD5: | A7D0573E705AE64868B5ED90C1F98F36 |
| SHA1: | B472C3F5005EADB55EBA9E94E3D9304FB52A4E55 |
| SHA-256: | 0E2EC7016374868C6E0106E93E6F11F1B3760D1960C4C64BF1F247149B529B11 |
| SHA-512: | F466FCC96FFF33E5B857FB1C52FABEA4A83A153E2CC1CEC66F5EBCA8C0E4E61C5F996B162A803BC9AB11BEA376A0B80E99479C19AC83F797339E1458C345EB13 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 54203 |
| Entropy (8bit): | 5.360158731620854 |
| Encrypted: | false |
| SSDEEP: | 1536:425QJQG/9WajWVxaSroT6LaGfmTjGvS+PSkk50:42SJQGFWajUEIoTKuTjGvSCSkk50 |
| MD5: | FD7918A6EE70CC9B6203E20A28EFBBFB |
| SHA1: | 91DB810F8FF57349AFF7FED57D18801167726590 |
| SHA-256: | 041651F5B0B965C2F827E167954F7FA689270887D3E13E79D9C13EAEE9E6857D |
| SHA-512: | C5B0A146BB814259385DFC6DE10E76ED4819D041F568E5E40369CC281039B19BA6DC32A480E353F819BAFB488481F8EC7D50D38EB4F418FC113E60ECBC136B9D |
| Malicious: | true |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.632562248014631 |
| TrID: |
|
| File name: | AwMu7gR48D.exe |
| File size: | 500'524 bytes |
| MD5: | e910dd39a106dfb09f31945608899357 |
| SHA1: | 3c769e1093522daf75c7425413a5d44dd3f29f7f |
| SHA256: | 6f4acfdbac861233f66afa46e67b349354826d039a367314f28f13fd7bfa5287 |
| SHA512: | ee160a5df59b154ad96dcf11862098a09d0502c8c7c78df2484a3cbd93da21c9a2ea4a79da3800ac38544b3217889f55d877cc70b86f71b43e87c9dce9125170 |
| SSDEEP: | 12288:SpC1NSIUW2qjUT8IiMGQb7jYF+Xg0x1Odt3xD:eC1UabQb2+XPMV |
| TLSH: | D9B40261BA50E4D6C83B46B576B3DC3129143DAB837251BF27A837EE5062273050BDAF |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L...#.uY.................`......... |
 | |
| Icon Hash: | 246445471b4f0f1f |
| Entrypoint: | 0x4031bb |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x59759523 [Mon Jul 24 06:35:15 2017 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 3abe302b6d9a1256e6a915429af4ffd2 |
| Instruction |
|---|
| sub esp, 00000184h |
| push ebx |
| push esi |
| push edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [esp+18h], ebx |
| mov dword ptr [esp+10h], 00409198h |
| mov dword ptr [esp+20h], ebx |
| mov byte ptr [esp+14h], 00000020h |
| call dword ptr [004070A0h] |
| call dword ptr [0040709Ch] |
| and eax, BFFFFFFFh |
| cmp ax, 00000006h |
| mov dword ptr [0042370Ch], eax |
| je 00007F2D450B35A3h |
| push ebx |
| call 00007F2D450B665Ah |
| cmp eax, ebx |
| je 00007F2D450B3599h |
| push 00000C00h |
| call eax |
| mov esi, 00407298h |
| push esi |
| call 00007F2D450B65D6h |
| push esi |
| call dword ptr [00407098h] |
| lea esi, dword ptr [esi+eax+01h] |
| cmp byte ptr [esi], bl |
| jne 00007F2D450B357Dh |
| push 0000000Ah |
| call 00007F2D450B662Eh |
| push 00000008h |
| call 00007F2D450B6627h |
| push 00000006h |
| mov dword ptr [00423704h], eax |
| call 00007F2D450B661Bh |
| cmp eax, ebx |
| je 00007F2D450B35A1h |
| push 0000001Eh |
| call eax |
| test eax, eax |
| je 00007F2D450B3599h |
| or byte ptr [0042370Fh], 00000040h |
| push ebp |
| call dword ptr [00407044h] |
| push ebx |
| call dword ptr [00407288h] |
| mov dword ptr [004237D8h], eax |
| push ebx |
| lea eax, dword ptr [esp+38h] |
| push 00000160h |
| push eax |
| push ebx |
| push 0041ECC8h |
| call dword ptr [00407178h] |
| push 00409188h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7428 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x33000 | 0x15788 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x298 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5ed2 | 0x6000 | 9112619c91f32f6f8e4096e108712ebe | False | 0.6629638671875 | data | 6.442176588686321 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x7000 | 0x1248 | 0x1400 | 1c9a524313c13059919ecf8195d205be | False | 0.4275390625 | data | 5.007650149182371 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x9000 | 0x1a818 | 0x400 | 458aeaedc3eabb1f26ec1bbd666017ae | False | 0.6396484375 | data | 5.13585559284969 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x24000 | 0xf000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x33000 | 0x15788 | 0x15800 | 40497017b2a1d5e01ad2b917ac12d1eb | False | 0.2589821039244186 | data | 4.486367209516884 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x332c8 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.21990713356204897 |
| RT_ICON | 0x43af0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.35072614107883815 |
| RT_ICON | 0x46098 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.39094746716697937 |
| RT_ICON | 0x47140 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.48811475409836064 |
| RT_ICON | 0x47ac8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.5523049645390071 |
| RT_DIALOG | 0x47f30 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0x48030 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x48150 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0x48218 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x48278 | 0x4c | data | English | United States | 0.8157894736842105 |
| RT_VERSION | 0x482c8 | 0x180 | data | English | United States | 0.5859375 |
| RT_MANIFEST | 0x48448 | 0x33e | XML 1.0 document, ASCII text, with very long lines (830), with no line terminators | English | United States | 0.5542168674698795 |
| DLL | Import |
|---|---|
| KERNEL32.dll | GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetCurrentDirectoryA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA |
| USER32.dll | ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA |
| ADVAPI32.dll | AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA |
| COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
| ole32.dll | OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-03T16:43:50.010223+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.9 | 49709 | 172.217.19.174 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 3, 2024 16:43:47.279522896 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:47.279575109 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:47.279665947 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:47.292957067 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:47.292999029 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:49.088512897 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:49.088618040 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:49.089355946 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:49.089418888 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:49.179348946 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:49.179380894 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:49.179785013 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:49.179833889 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:49.183219910 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:49.223330021 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:50.010217905 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:50.010442019 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:50.010467052 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:50.010591984 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:50.011008024 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:50.011030912 CET | 443 | 49709 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:50.011117935 CET | 49709 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:50.267216921 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:50.267265081 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:50.267369032 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:50.267718077 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:50.267730951 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:51.972306013 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:51.972426891 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:51.976845980 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:51.976888895 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:51.977178097 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:51.977279902 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:51.977626085 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:52.023344040 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:52.926780939 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:52.926940918 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:52.926964998 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:52.927038908 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:52.927529097 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:52.927596092 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:52.927783966 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:52.927833080 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:52.927843094 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:52.927886963 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:52.942373991 CET | 49710 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:52.942398071 CET | 443 | 49710 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:53.062191963 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:53.062244892 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:53.062413931 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:53.062766075 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:53.062777996 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:54.950972080 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:54.951081038 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:54.951767921 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:54.951838970 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:54.954103947 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:54.954122066 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:54.954376936 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:54.954428911 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:54.954955101 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:54.999336004 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:55.880552053 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:55.880697012 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:55.880711079 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:55.880754948 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:55.880903959 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:55.880950928 CET | 443 | 49711 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:55.881057024 CET | 49711 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:55.891484022 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:55.891542912 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:55.891630888 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:55.891940117 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:55.891951084 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:57.639349937 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:57.639460087 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:57.640193939 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:57.640203953 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:57.640398979 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:57.640403986 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:58.597474098 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:58.597609997 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:58.597637892 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:58.597816944 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:58.598123074 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:58.598190069 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:58.598190069 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:58.598258018 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:58.599096060 CET | 49712 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:43:58.599117994 CET | 443 | 49712 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:58.749149084 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:58.749196053 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:43:58.749269962 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:58.760560036 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:43:58.760596037 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:00.516244888 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:00.516472101 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:00.516994953 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:00.517060041 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:00.519001007 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:00.519013882 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:00.519256115 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:00.519306898 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:00.519738913 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:00.567338943 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:01.426670074 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:01.426794052 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:01.426815987 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:01.426892042 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:01.427006960 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:01.427082062 CET | 443 | 49714 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:01.427164078 CET | 49714 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:01.437412977 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:01.437464952 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:01.437573910 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:01.437891960 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:01.437906027 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:03.234215021 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:03.234369040 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:03.257872105 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:03.257882118 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:03.258059025 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:03.258064985 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:04.214066029 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:04.214364052 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:04.214812994 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:04.214879990 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:04.215167046 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:04.215209961 CET | 443 | 49715 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:04.215270996 CET | 49715 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:04.343247890 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:04.343305111 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:04.343400955 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:04.343759060 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:04.343774080 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.038901091 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.039170980 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.039722919 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.039779902 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.050128937 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.050148010 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.050430059 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.050498962 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.050839901 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.095335960 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.949820995 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.949906111 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.949924946 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.950263023 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.951102018 CET | 49716 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:06.951117992 CET | 443 | 49716 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.969445944 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:06.969497919 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:06.969572067 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:06.969825029 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:06.969836950 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:08.709683895 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:08.709764004 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:08.742424965 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:08.742443085 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:08.742755890 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:08.742805958 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:08.750181913 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:08.791321993 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:09.692127943 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:09.692229033 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:09.692574024 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:09.692625999 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:09.693082094 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:09.693119049 CET | 443 | 49717 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:09.693175077 CET | 49717 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:09.811568022 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:09.811624050 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:09.811698914 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:09.811942101 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:09.811954021 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:11.553297997 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:11.553404093 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:11.553858995 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:11.553875923 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:11.554075956 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:11.554083109 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:12.469752073 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:12.469875097 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:12.469892979 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:12.469939947 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:12.469984055 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:12.470062017 CET | 443 | 49718 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:12.470122099 CET | 49718 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:12.477447033 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:12.477497101 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:12.477577925 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:12.477782965 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:12.477799892 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:14.273379087 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:14.273595095 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:14.275922060 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:14.275933027 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:14.276973009 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:14.277041912 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:14.277436018 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:14.323323965 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:15.249146938 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:15.249291897 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:15.249852896 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:15.249907970 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:15.249953985 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:15.250020981 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:15.250082016 CET | 443 | 49719 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:15.250108004 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:15.250145912 CET | 49719 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:15.373684883 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:15.373744965 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:15.373846054 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:15.374078989 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:15.374089956 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.072827101 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.073050022 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.073612928 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.073667049 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.076267004 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.076281071 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.076546907 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.078547955 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.078831911 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.123330116 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.986525059 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.986736059 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.986766100 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.986828089 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.986871958 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:17.986907959 CET | 443 | 49720 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:17.986968040 CET | 49720 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:18.004483938 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:18.004520893 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:18.004595995 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:18.004983902 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:18.004993916 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:19.742727995 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:19.742794037 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:19.744600058 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:19.744612932 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:19.744862080 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:19.744930983 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:19.745258093 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:19.791342974 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:20.721093893 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:20.721230030 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:20.721265078 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:20.721405983 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:20.721787930 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:20.721851110 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:20.722237110 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:20.722282887 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:20.722438097 CET | 443 | 49721 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:20.722507954 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:20.722527027 CET | 49721 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:20.846344948 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:20.846400976 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:20.846457005 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:20.846999884 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:20.847011089 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:22.592969894 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:22.593075991 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:22.593729019 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:22.593794107 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:22.598058939 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:22.598071098 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:22.598354101 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:22.598407030 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:22.599080086 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:22.639333010 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:23.532397032 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:23.532538891 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:23.532645941 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:23.532686949 CET | 443 | 49723 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:23.532773972 CET | 49723 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:23.541776896 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:23.541826010 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:23.542181015 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:23.542388916 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:23.542403936 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:25.328674078 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:25.328752041 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:25.331906080 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:25.331928015 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:25.332174063 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:25.332240105 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:25.332541943 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:25.379343987 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:26.317567110 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:26.317718983 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:26.318268061 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:26.318327904 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:26.318416119 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:26.318454981 CET | 443 | 49725 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:26.318504095 CET | 49725 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:26.436965942 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:26.437019110 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:26.437191963 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:26.437383890 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:26.437393904 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:28.194206953 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:28.194475889 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:28.194964886 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:28.195034027 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:28.199289083 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:28.199310064 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:28.199585915 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:28.199636936 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:28.200088024 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:28.243331909 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:29.111825943 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:29.111933947 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:29.111948967 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:29.111995935 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:29.112260103 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:29.112297058 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:29.112353086 CET | 49726 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:29.124687910 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:29.124728918 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:29.124805927 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:29.125021935 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:29.125031948 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:30.818402052 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:30.818623066 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:30.819070101 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:30.819082975 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:30.819258928 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:30.819264889 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:31.772964954 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:31.773149967 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:31.773467064 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:31.773540020 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:31.773549080 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:31.773561001 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:31.773601055 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:31.773920059 CET | 49727 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:31.773937941 CET | 443 | 49727 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:31.889610052 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:31.889667034 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:31.889759064 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:31.890043020 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:31.890058994 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:33.628060102 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:33.628158092 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:33.628840923 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:33.628901958 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:33.630754948 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:33.630767107 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:33.631026030 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:33.631092072 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:33.631457090 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:33.675333023 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:34.552949905 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:34.553029060 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:34.553059101 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:34.553113937 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:34.553164005 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:34.553199053 CET | 443 | 49728 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:34.553248882 CET | 49728 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:34.571691990 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:34.571746111 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:34.571810961 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:34.572031021 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:34.572050095 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:36.309745073 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:36.309849024 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:36.310332060 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:36.310350895 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:36.310488939 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:36.310492992 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:37.577512980 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:37.577613115 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:37.577975035 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:37.578018904 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:37.578507900 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:37.578547001 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:37.578553915 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:37.578594923 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:37.578757048 CET | 49729 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:37.578771114 CET | 443 | 49729 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:37.702115059 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:37.702155113 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:37.702245951 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:37.702558994 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:37.702569008 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:39.492083073 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:39.492206097 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:39.492862940 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:39.492934942 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:39.494385004 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:39.494395971 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:39.494642019 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:39.494697094 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:39.494968891 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:39.539326906 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:40.420742035 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:40.421013117 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:40.421161890 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:40.421169043 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:40.421205997 CET | 443 | 49730 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:40.421436071 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:40.421452045 CET | 49730 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:40.430839062 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:40.430888891 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:40.430993080 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:40.431189060 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:40.431202888 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:42.172291994 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:42.172488928 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:42.172950983 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:42.172961950 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:42.173151016 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:42.173155069 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.128418922 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.128550053 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.128559113 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:43.128587008 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.128601074 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:43.128635883 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:43.128948927 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.128988981 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.128993034 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:43.129035950 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:43.129359007 CET | 49731 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:43.129373074 CET | 443 | 49731 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.249119043 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:43.249171972 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:43.249274015 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:43.249536991 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:43.249551058 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:45.198451042 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:45.198586941 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:45.199331045 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:45.199342012 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:45.199601889 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:45.199608088 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:46.108726025 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:46.108844042 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:46.108876944 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:46.108925104 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:46.109029055 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:46.109086990 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:46.109138012 CET | 443 | 49732 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:46.109147072 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:46.109195948 CET | 49732 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:46.133516073 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:46.133586884 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:46.133687019 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:46.134076118 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:46.134090900 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:47.873477936 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:47.876591921 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:47.877047062 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:47.877060890 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:47.877211094 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:47.877217054 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:48.831398010 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:48.831494093 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:48.832250118 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:48.832303047 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:48.832319975 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:48.832331896 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:48.832359076 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:48.832365036 CET | 443 | 49733 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:48.832376003 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:48.832390070 CET | 49733 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:48.952140093 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:48.952203035 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:48.952291965 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:48.952579975 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:48.952589989 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:50.647660971 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:50.647816896 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:50.648356915 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:50.648367882 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:50.648525000 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:50.648530960 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:51.564898014 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:51.564980984 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:51.565010071 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:51.565053940 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:51.567701101 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:51.567735910 CET | 443 | 49734 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:51.567783117 CET | 49734 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:51.586157084 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:51.586263895 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:51.586350918 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:51.586570978 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:51.586611986 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:53.328178883 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:53.328253984 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:53.328727007 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:53.328744888 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:53.328923941 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:53.328937054 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:54.318422079 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:54.318547010 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:54.319395065 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:54.319459915 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:54.321230888 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:54.321288109 CET | 443 | 49735 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:54.321352959 CET | 49735 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:54.452446938 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:54.452507973 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:54.452586889 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:54.452855110 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:54.452868938 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:56.240212917 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:56.240490913 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:56.240951061 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:56.241014004 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:56.242995024 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:56.243012905 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:56.243284941 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:56.243334055 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:56.244051933 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:56.287337065 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:57.168283939 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:57.168440104 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:57.168477058 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:57.168546915 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:57.168616056 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:57.168677092 CET | 443 | 49736 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:44:57.168725014 CET | 49736 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:44:57.192662001 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:57.192713976 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:57.192784071 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:57.193043947 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:57.193056107 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:58.936523914 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:58.936599970 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:58.939588070 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:58.939594984 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:58.939846039 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:58.939898014 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:58.940387011 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:58.987349033 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:59.902368069 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:59.902553082 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:59.902667046 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:59.902724028 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:59.903300047 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:59.903366089 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:59.903420925 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:44:59.903433084 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:44:59.903476954 CET | 49737 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:45:00.030179977 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:00.030239105 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:00.030313015 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:00.030597925 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:00.030611992 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:01.820372105 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:01.820453882 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:01.821099043 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:01.821161032 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:01.822551012 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:01.822570086 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:01.822789907 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:01.822838068 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:01.823111057 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:01.867340088 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:02.752809048 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:02.752948046 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:02.752979994 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:02.753025055 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:02.753155947 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:02.753187895 CET | 443 | 49738 | 172.217.19.174 | 192.168.2.9 |
| Dec 3, 2024 16:45:02.753237009 CET | 49738 | 443 | 192.168.2.9 | 172.217.19.174 |
| Dec 3, 2024 16:45:02.764986038 CET | 49739 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:45:02.765036106 CET | 443 | 49739 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:45:02.765117884 CET | 49739 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:45:02.765377998 CET | 49739 | 443 | 192.168.2.9 | 142.250.181.1 |
| Dec 3, 2024 16:45:02.765393019 CET | 443 | 49739 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:45:04.550244093 CET | 443 | 49739 | 142.250.181.1 | 192.168.2.9 |
| Dec 3, 2024 16:45:04.550528049 CET | 49739 | 443 | 192.168.2.9 | 142.250.181.1 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 3, 2024 16:43:47.133393049 CET | 53934 | 53 | 192.168.2.9 | 1.1.1.1 |
| Dec 3, 2024 16:43:47.273042917 CET | 53 | 53934 | 1.1.1.1 | 192.168.2.9 |
| Dec 3, 2024 16:43:50.036622047 CET | 51526 | 53 | 192.168.2.9 | 1.1.1.1 |
| Dec 3, 2024 16:43:50.265825987 CET | 53 | 51526 | 1.1.1.1 | 192.168.2.9 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 3, 2024 16:43:47.133393049 CET | 192.168.2.9 | 1.1.1.1 | 0x10e4 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 3, 2024 16:43:50.036622047 CET | 192.168.2.9 | 1.1.1.1 | 0x5fcc | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 3, 2024 16:43:47.273042917 CET | 1.1.1.1 | 192.168.2.9 | 0x10e4 | No error (0) | 172.217.19.174 | A (IP address) | IN (0x0001) | false | ||
| Dec 3, 2024 16:43:50.265825987 CET | 1.1.1.1 | 192.168.2.9 | 0x5fcc | No error (0) | 142.250.181.1 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.9 | 49709 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:43:49 UTC | 216 | OUT | |
| 2024-12-03 15:43:50 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.9 | 49710 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:43:51 UTC | 258 | OUT | |
| 2024-12-03 15:43:52 UTC | 2229 | IN | |
| 2024-12-03 15:43:52 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.9 | 49711 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:43:54 UTC | 418 | OUT | |
| 2024-12-03 15:43:55 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.9 | 49712 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:43:57 UTC | 460 | OUT | |
| 2024-12-03 15:43:58 UTC | 1854 | IN | |
| 2024-12-03 15:43:58 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.9 | 49714 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:00 UTC | 418 | OUT | |
| 2024-12-03 15:44:01 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.9 | 49715 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:03 UTC | 460 | OUT | |
| 2024-12-03 15:44:04 UTC | 1854 | IN | |
| 2024-12-03 15:44:04 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.9 | 49716 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:06 UTC | 418 | OUT | |
| 2024-12-03 15:44:06 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.9 | 49717 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:08 UTC | 460 | OUT | |
| 2024-12-03 15:44:09 UTC | 1854 | IN | |
| 2024-12-03 15:44:09 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.9 | 49718 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:11 UTC | 418 | OUT | |
| 2024-12-03 15:44:12 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.9 | 49719 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:14 UTC | 460 | OUT | |
| 2024-12-03 15:44:15 UTC | 1854 | IN | |
| 2024-12-03 15:44:15 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.9 | 49720 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:17 UTC | 418 | OUT | |
| 2024-12-03 15:44:17 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.9 | 49721 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:19 UTC | 460 | OUT | |
| 2024-12-03 15:44:20 UTC | 1854 | IN | |
| 2024-12-03 15:44:20 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.9 | 49723 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:22 UTC | 418 | OUT | |
| 2024-12-03 15:44:23 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.9 | 49725 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:25 UTC | 460 | OUT | |
| 2024-12-03 15:44:26 UTC | 1854 | IN | |
| 2024-12-03 15:44:26 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.9 | 49726 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:28 UTC | 418 | OUT | |
| 2024-12-03 15:44:29 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.9 | 49727 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:30 UTC | 460 | OUT | |
| 2024-12-03 15:44:31 UTC | 1854 | IN | |
| 2024-12-03 15:44:31 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.9 | 49728 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:33 UTC | 418 | OUT | |
| 2024-12-03 15:44:34 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.9 | 49729 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:36 UTC | 460 | OUT | |
| 2024-12-03 15:44:37 UTC | 1854 | IN | |
| 2024-12-03 15:44:37 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.9 | 49730 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:39 UTC | 418 | OUT | |
| 2024-12-03 15:44:40 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.9 | 49731 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:42 UTC | 460 | OUT | |
| 2024-12-03 15:44:43 UTC | 1854 | IN | |
| 2024-12-03 15:44:43 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.9 | 49732 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:45 UTC | 418 | OUT | |
| 2024-12-03 15:44:46 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.9 | 49733 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:47 UTC | 460 | OUT | |
| 2024-12-03 15:44:48 UTC | 1854 | IN | |
| 2024-12-03 15:44:48 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.9 | 49734 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:50 UTC | 418 | OUT | |
| 2024-12-03 15:44:51 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.9 | 49735 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:53 UTC | 460 | OUT | |
| 2024-12-03 15:44:54 UTC | 1854 | IN | |
| 2024-12-03 15:44:54 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.9 | 49736 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:56 UTC | 418 | OUT | |
| 2024-12-03 15:44:57 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.9 | 49737 | 142.250.181.1 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:44:58 UTC | 460 | OUT | |
| 2024-12-03 15:44:59 UTC | 1854 | IN | |
| 2024-12-03 15:44:59 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.9 | 49738 | 172.217.19.174 | 443 | 4516 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:45:01 UTC | 418 | OUT | |
| 2024-12-03 15:45:02 UTC | 1920 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 10:42:57 |
| Start date: | 03/12/2024 |
| Path: | C:\Users\user\Desktop\AwMu7gR48D.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 500'524 bytes |
| MD5 hash: | E910DD39A106DFB09F31945608899357 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 10:43:01 |
| Start date: | 03/12/2024 |
| Path: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xd20000 |
| File size: | 433'152 bytes |
| MD5 hash: | C32CA4ACFCC635EC1EA6ED8A34DF5FAC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 10:43:01 |
| Start date: | 03/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff70f010000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 10:43:38 |
| Start date: | 03/12/2024 |
| Path: | C:\Windows\SysWOW64\msiexec.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x560000 |
| File size: | 59'904 bytes |
| MD5 hash: | 9D09DC1EDA745A5F87553048E57620CF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 20.4% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 21.1% |
| Total number of Nodes: | 1334 |
| Total number of Limit Nodes: | 32 |
Graph
Function 004031BB Relevance: 89.6, APIs: 33, Strings: 18, Instructions: 368stringcomfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405194 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004056F7 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004065BB Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403B1C Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040377F Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405F51 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405056 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406259 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405E16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004055CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004069F0 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406BF1 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406907 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040640C Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040685A Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406978 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004068C4 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401B5D Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AC8 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AA3 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405599 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B40 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B6F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040403C Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403173 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405611 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404025 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404012 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401EDB Relevance: 1.3, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004049D3 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404460 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004026F8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404139 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B9E Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404057 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404921 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C61 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404817 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D95 Relevance: 7.5, APIs: 5, Instructions: 43COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004059B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004058C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402CE4 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404FCA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040590E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405A2D Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0758D55C Relevance: .3, Instructions: 333COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07584D68 Relevance: 1.1, Instructions: 1098COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07583278 Relevance: 1.0, Instructions: 978COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07584D4A Relevance: .9, Instructions: 887COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 075840A2 Relevance: .6, Instructions: 644COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0758D023 Relevance: .6, Instructions: 621COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07581228 Relevance: .6, Instructions: 600COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0758C830 Relevance: .5, Instructions: 504COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 075841B4 Relevance: .5, Instructions: 487COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0758D10A Relevance: .5, Instructions: 468COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 09010E28 Relevance: .4, Instructions: 396COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 09011800 Relevance: .4, Instructions: 390COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 09010468 Relevance: .2, Instructions: 212COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07580C68 Relevance: .2, Instructions: 171COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07580AF0 Relevance: .1, Instructions: 120COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 09010458 Relevance: .1, Instructions: 118COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 09010E18 Relevance: .1, Instructions: 116COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 090117FA Relevance: .1, Instructions: 112COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 075848F0 Relevance: .1, Instructions: 102COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07586114 Relevance: .1, Instructions: 98COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07580FD0 Relevance: .1, Instructions: 94COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07580FB4 Relevance: .1, Instructions: 86COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07588643 Relevance: .0, Instructions: 49COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 09011EDA Relevance: .0, Instructions: 31COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07581CB6 Relevance: .0, Instructions: 5COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|