Edit tour
Windows
Analysis Report
Bank Swift and SOA PRN0072003410853_pdf.exe
Overview
General Information
| Sample name: | Bank Swift and SOA PRN0072003410853_pdf.exe |
| Analysis ID: | 1568136 |
| MD5: | eb15bbefe683ef09c1c5c1bf5068dd71 |
| SHA1: | 0b613412103c088372fb19656152d21d6a5db027 |
| SHA256: | 8250c1a738d87ed5e8f7d743fa4b523a8c662c568f97b05de5712e9f2c39c647 |
| Tags: | exeuser-julianmckein |
| Infos: |  |
 | |
Detection
GuLoader, MassLogger RAT
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected GuLoader
Yara detected MassLogger RAT
Yara detected Telegram RAT
AI detected suspicious sample
Disable Task Manager(disabletaskmgr)
Disables CMD prompt
Disables the Windows task manager (taskmgr)
Initial sample is a PE file and has a suspicious name
Switches to a custom stack to bypass stack traces
Tries to detect the country of the analysis system (by using the IP)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Classification
- System is w10x64
Bank Swift and SOA PRN0072003410853_pdf.exe (PID: 7260 cmdline: "C:\Users\ user\Deskt op\Bank Sw ift and SO A PRN00720 03410853_p df.exe" MD5: EB15BBEFE683EF09C1C5C1BF5068DD71) - Bank Swift and SOA PRN0072003410853_pdf.exe (PID: 7576 cmdline:
"C:\Users\ user\Deskt op\Bank Sw ift and SO A PRN00720 03410853_p df.exe" MD5: EB15BBEFE683EF09C1C5C1BF5068DD71)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
{"C2 url": "https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendMessage"}{"EXfil Mode": "Telegram", "Telegram Token": "7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU", "Telegram Chatid": "7382809095"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_5 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_5 | Yara detected GuLoader | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_5 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_5 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_5 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_MassLogger | Yara detected MassLogger RAT | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| Click to see the 5 entries | ||||
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-04T11:10:46.518416+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49779 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:10:50.615411+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49790 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:10:54.265274+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49799 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:10:57.897097+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49810 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:01.583875+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49821 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:05.271299+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49830 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:08.882443+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49842 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:12.467151+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49851 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:16.359602+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49861 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:20.031781+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49873 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:23.745606+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49883 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:28.276507+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49895 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:32.738827+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49909 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:36.637819+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49918 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:40.704591+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49929 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:44.432301+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49939 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:48.168639+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49948 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:51.977951+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49959 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:55.740334+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49970 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:59.303616+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49980 | 149.154.167.220 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-04T11:10:34.869877+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49748 | 132.226.8.169 | 80 | TCP |
| 2024-12-04T11:10:44.338662+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49748 | 132.226.8.169 | 80 | TCP |
| 2024-12-04T11:10:48.651116+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49785 | 132.226.8.169 | 80 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-04T11:10:26.346082+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49726 | 172.217.19.174 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
Location Tracking | |
|---|
| Source: | DNS query: | ||
| Source: | Code function: | 3_2_356CB4C0 | |
| Source: | Code function: | 3_2_356CBCB8 | |
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00405772 | |
| Source: | Code function: | 0_2_0040622D | |
| Source: | Code function: | 0_2_00402770 | |
| Source: | Code function: | 3_2_00402770 | |
| Source: | Code function: | 3_2_00405772 | |
| Source: | Code function: | 3_2_0040622D | |
| Source: | Code function: | 3_2_0015E6A8 | |
| Source: | Code function: | 3_2_0015EC58 | |
| Source: | Code function: | 3_2_0015EFAF | |
| Source: | Code function: | 3_2_356CA928 | |
| Source: | Code function: | 3_2_356CF3F8 | |
| Source: | Code function: | 3_2_356CBD78 | |
| Source: | Code function: | 3_2_356C9370 | |
| Source: | Code function: | 3_2_356CEB48 | |
| Source: | Code function: | 3_2_356CD330 | |
| Source: | Code function: | 3_2_356C97C8 | |
| Source: | Code function: | 3_2_356CC1D0 | |
| Source: | Code function: | 3_2_356CEFA0 | |
| Source: | Code function: | 3_2_356CA078 | |
| Source: | Code function: | 3_2_356CF850 | |
| Source: | Code function: | 3_2_356CC628 | |
| Source: | Code function: | 3_2_356C9C20 | |
| Source: | Code function: | 3_2_356CE6F0 | |
| Source: | Code function: | 3_2_356CCED8 | |
| Source: | Code function: | 3_2_356CA4D0 | |
| Source: | Code function: | 3_2_356CCA80 | |
| Source: | Code function: | 3_2_356E6130 | |
| Source: | Code function: | 3_2_356E6130 | |
| Source: | Code function: | 3_2_356E98D0 | |
| Source: | Code function: | 3_2_356E15F8 | |
| Source: | Code function: | 3_2_356E3598 | |
| Source: | Code function: | 3_2_356E0498 | |
| Source: | Code function: | 3_2_356E5631 | |
| Source: | Code function: | 3_2_356E46F8 | |
| Source: | Code function: | 3_2_356EA6C7 | |
| Source: | Code function: | 3_2_356E3140 | |
| Source: | Code function: | 3_2_356E11A0 | |
| Source: | Code function: | 3_2_356E0040 | |
| Source: | Code function: | 3_2_356E2300 | |
| Source: | Code function: | 3_2_356E42A0 | |
| Source: | Code function: | 3_2_356E0D48 | |
| Source: | Code function: | 3_2_356E2CE8 | |
| Source: | Code function: | 3_2_356E4FA8 | |
| Source: | Code function: | 3_2_356E3E48 | |
| Source: | Code function: | 3_2_356E1EA8 | |
| Source: | Code function: | 3_2_356E39F0 | |
| Source: | Code function: | 3_2_356E08F0 | |
| Source: | Code function: | 3_2_356E2890 | |
| Source: | Code function: | 3_2_356E4B50 | |
| Source: | Code function: | 3_2_356E1A50 | |
| Source: | Code function: | 3_2_3675E600 | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_004052D3 | |
System Summary | |
|---|
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_0040335A | |
| Source: | Code function: | 3_2_0040335A | |
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00404B10 | |
| Source: | Code function: | 0_2_0040653F | |
| Source: | Code function: | 3_2_00404B10 | |
| Source: | Code function: | 3_2_0040653F | |
| Source: | Code function: | 3_2_00154328 | |
| Source: | Code function: | 3_2_0015E6A8 | |
| Source: | Code function: | 3_2_00158DA0 | |
| Source: | Code function: | 3_2_00155968 | |
| Source: | Code function: | 3_2_00155F90 | |
| Source: | Code function: | 3_2_0015E6A3 | |
| Source: | Code function: | 3_2_00152DD1 | |
| Source: | Code function: | 3_2_356C4350 | |
| Source: | Code function: | 3_2_356C5B28 | |
| Source: | Code function: | 3_2_356CA928 | |
| Source: | Code function: | 3_2_356CF3F8 | |
| Source: | Code function: | 3_2_356CAF80 | |
| Source: | Code function: | 3_2_356CBD68 | |
| Source: | Code function: | 3_2_356C9361 | |
| Source: | Code function: | 3_2_356CBD78 | |
| Source: | Code function: | 3_2_356C9370 | |
| Source: | Code function: | 3_2_356C5170 | |
| Source: | Code function: | 3_2_356CEB48 | |
| Source: | Code function: | 3_2_356CEB42 | |
| Source: | Code function: | 3_2_356CAF55 | |
| Source: | Code function: | 3_2_356CD321 | |
| Source: | Code function: | 3_2_356CD330 | |
| Source: | Code function: | 3_2_356C5908 | |
| Source: | Code function: | 3_2_356CA919 | |
| Source: | Code function: | 3_2_356CF3EA | |
| Source: | Code function: | 3_2_356C97C8 | |
| Source: | Code function: | 3_2_356CC1C0 | |
| Source: | Code function: | 3_2_356CC1D0 | |
| Source: | Code function: | 3_2_356CEFA0 | |
| Source: | Code function: | 3_2_356C97B9 | |
| Source: | Code function: | 3_2_356CD788 | |
| Source: | Code function: | 3_2_356C5180 | |
| Source: | Code function: | 3_2_356CEF90 | |
| Source: | Code function: | 3_2_356CA068 | |
| Source: | Code function: | 3_2_356CA078 | |
| Source: | Code function: | 3_2_356CCA70 | |
| Source: | Code function: | 3_2_356C1048 | |
| Source: | Code function: | 3_2_356CF842 | |
| Source: | Code function: | 3_2_356CF850 | |
| Source: | Code function: | 3_2_356CC628 | |
| Source: | Code function: | 3_2_356C9C20 | |
| Source: | Code function: | 3_2_356CE60A | |
| Source: | Code function: | 3_2_356CC618 | |
| Source: | Code function: | 3_2_356C9C11 | |
| Source: | Code function: | 3_2_356C60FE | |
| Source: | Code function: | 3_2_356CE6F0 | |
| Source: | Code function: | 3_2_356CCEC8 | |
| Source: | Code function: | 3_2_356CA4C0 | |
| Source: | Code function: | 3_2_356CCED8 | |
| Source: | Code function: | 3_2_356CA4D0 | |
| Source: | Code function: | 3_2_356CCA80 | |
| Source: | Code function: | 3_2_356E9568 | |
| Source: | Code function: | 3_2_356E8490 | |
| Source: | Code function: | 3_2_356E77F0 | |
| Source: | Code function: | 3_2_356E6130 | |
| Source: | Code function: | 3_2_356E71A8 | |
| Source: | Code function: | 3_2_356EF0F0 | |
| Source: | Code function: | 3_2_356E7E40 | |
| Source: | Code function: | 3_2_356E98D0 | |
| Source: | Code function: | 3_2_356E15F8 | |
| Source: | Code function: | 3_2_356E15F3 | |
| Source: | Code function: | 3_2_356E3588 | |
| Source: | Code function: | 3_2_356E3598 | |
| Source: | Code function: | 3_2_356E0488 | |
| Source: | Code function: | 3_2_356E8481 | |
| Source: | Code function: | 3_2_356E0498 | |
| Source: | Code function: | 3_2_356E77E0 | |
| Source: | Code function: | 3_2_356E5631 | |
| Source: | Code function: | 3_2_356E46E8 | |
| Source: | Code function: | 3_2_356E46F8 | |
| Source: | Code function: | 3_2_356E3140 | |
| Source: | Code function: | 3_2_356E6121 | |
| Source: | Code function: | 3_2_356E3130 | |
| Source: | Code function: | 3_2_356E11A0 | |
| Source: | Code function: | 3_2_356E1190 | |
| Source: | Code function: | 3_2_356E0040 | |
| Source: | Code function: | 3_2_356EE030 | |
| Source: | Code function: | 3_2_356E0011 | |
| Source: | Code function: | 3_2_356E2300 | |
| Source: | Code function: | 3_2_356E22F1 | |
| Source: | Code function: | 3_2_356E42A0 | |
| Source: | Code function: | 3_2_356E4291 | |
| Source: | Code function: | 3_2_356E0D48 | |
| Source: | Code function: | 3_2_356E0D38 | |
| Source: | Code function: | 3_2_356E2CE8 | |
| Source: | Code function: | 3_2_356E2CD8 | |
| Source: | Code function: | 3_2_356E4FA8 | |
| Source: | Code function: | 3_2_356E4F99 | |
| Source: | Code function: | 3_2_356E3E48 | |
| Source: | Code function: | 3_2_356E3E38 | |
| Source: | Code function: | 3_2_356E7E30 | |
| Source: | Code function: | 3_2_356E1EA8 | |
| Source: | Code function: | 3_2_356E1E98 | |
| Source: | Code function: | 3_2_356E39E0 | |
| Source: | Code function: | 3_2_356E39F0 | |
| Source: | Code function: | 3_2_356E287F | |
| Source: | Code function: | 3_2_356E08E0 | |
| Source: | Code function: | 3_2_356E08F0 | |
| Source: | Code function: | 3_2_356E98C0 | |
| Source: | Code function: | 3_2_356E2890 | |
| Source: | Code function: | 3_2_356E4B40 | |
| Source: | Code function: | 3_2_356E4B50 | |
| Source: | Code function: | 3_2_356E1A41 | |
| Source: | Code function: | 3_2_356E1A50 | |
| Source: | Code function: | 3_2_356E8AC9 | |
| Source: | Code function: | 3_2_356E8AD8 | |
| Source: | Code function: | 3_2_3675E600 | |
| Source: | Code function: | 3_2_3675D478 | |
| Source: | Code function: | 3_2_3675C4E0 | |
| Source: | Code function: | 3_2_3675E5F7 | |
| Source: | Code function: | 3_2_36753217 | |
| Source: | Code function: | 3_2_367573D0 | |
| Source: | Code function: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004045CA | |
| Source: | Code function: | 0_2_0040206A | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_00406254 | |
| Source: | Code function: | 0_2_10002DCE | |
| Source: | File created: | Jump to dropped file | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | API/Special instruction interceptor: | ||
| Source: | API/Special instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | API coverage: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Code function: | 0_2_00405772 | |
| Source: | Code function: | 0_2_0040622D | |
| Source: | Code function: | 0_2_00402770 | |
| Source: | Code function: | 3_2_00402770 | |
| Source: | Code function: | 3_2_00405772 | |
| Source: | Code function: | 3_2_0040622D | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-4797 | ||
| Source: | API call chain: | graph_0-4799 | ||
| Source: | Code function: | 0_2_00406254 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00405F0C | |
| Source: | Key value queried: | Jump to behavior | ||
Lowering of HIPS / PFW / Operating System Security Settings | |
|---|
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Registry key created or modified: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 1 DLL Side-Loading | 11 Process Injection | 11 Masquerading | 1 OS Credential Dumping | 21 Security Software Discovery | Remote Services | 1 Email Collection | 1 Web Service | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 31 Disable or Modify Tools | LSASS Memory | 31 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Archive Collected Data | 21 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 31 Virtualization/Sandbox Evasion | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | 1 Data from Local System | 1 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 1 System Network Configuration Discovery | Distributed Component Object Model | 1 Clipboard Data | 3 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | 2 File and Directory Discovery | SSH | Keylogging | 14 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 3 Obfuscated Files or Information | Cached Domain Credentials | 215 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 16% | ReversingLabs | Win32.Trojan.Generic | ||
| 100% | Avira | HEUR/AGEN.1337946 |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 172.217.19.174 | true | false | high | |
| drive.usercontent.google.com | 142.250.181.1 | true | false | high | |
| reallyfreegeoip.org | 104.21.67.152 | true | false | high | |
| api.telegram.org | 149.154.167.220 | true | false | high | |
| checkip.dyndns.com | 132.226.8.169 | true | false | high | |
| checkip.dyndns.org | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 132.226.8.169 | checkip.dyndns.com | United States | 16989 | UTMEMUS | false | |
| 149.154.167.220 | api.telegram.org | United Kingdom | 62041 | TELEGRAMRU | false | |
| 142.250.181.1 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false | |
| 104.21.67.152 | reallyfreegeoip.org | United States | 13335 | CLOUDFLARENETUS | false | |
| 172.217.19.174 | drive.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1568136 |
| Start date and time: | 2024-12-04 11:09:05 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 29s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 5 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Bank Swift and SOA PRN0072003410853_pdf.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@3/8@6/5 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: Bank Swift and SOA PRN0072003410853_pdf.exe
| Time | Type | Description |
|---|---|---|
| 05:10:43 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 132.226.8.169 | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla, MassLogger RAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
| 149.154.167.220 | Get hash | malicious | Discord Token Stealer, DotStealer | Browse | ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| 104.21.67.152 | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger | Browse | |||
| Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | MassLogger RAT | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| reallyfreegeoip.org | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| api.telegram.org | Get hash | malicious | Discord Token Stealer, DotStealer | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| checkip.dyndns.com | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| TELEGRAMRU | Get hash | malicious | Discord Token Stealer, DotStealer | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| UTMEMUS | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | RHADAMANTHYS | Browse |
| |
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Discord Token Stealer, DotStealer | Browse |
| ||
| Get hash | malicious | AgentTesla, GuLoader | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Remcos, GuLoader | Browse |
| |
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | FormBook, GuLoader | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nst3F37.tmp\System.dll | Get hash | malicious | GuLoader, Snake Keylogger | Browse | ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | Azorult, GuLoader | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1271914 |
| Entropy (8bit): | 3.5003059002187245 |
| Encrypted: | false |
| SSDEEP: | 6144:/g8rRdV9uzfmzNr60QfyeUgGOl2k9CJkcNSb9dpaD5u9ScaPZ+ewcR/c+9F7H45J:48rRdV9MmJm3qob5aD5TwdWpKJ |
| MD5: | 4AD64D8DE06AC4132B99BC8B05840F61 |
| SHA1: | E436AC4ADEF9ABB84B387D483844AA576A373AEF |
| SHA-256: | 5C1FE97ADF9659EDB188F48507FA3CDF24F11B8D9AE7FFEB98EA72623D3AD303 |
| SHA-512: | 5152D3299D7AA56F320629353BFB4A66265C6A4E23D1DF0269EE2AD4A9CB40B0A59E18A8D4A3A9FBAE6A88C8884EE5438419C0749BF3325B418660703ECD8B0B |
| Malicious: | true |
| Yara Hits: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11264 |
| Entropy (8bit): | 5.801108840712148 |
| Encrypted: | false |
| SSDEEP: | 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk |
| MD5: | FC90DFB694D0E17B013D6F818BCE41B0 |
| SHA1: | 3243969886D640AF3BFA442728B9F0DFF9D5F5B0 |
| SHA-256: | 7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528 |
| SHA-512: | 324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Hvirvelstroemmen\Cynomoriaceous.Spi172
Download File
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 123110 |
| Entropy (8bit): | 4.608314099965507 |
| Encrypted: | false |
| SSDEEP: | 1536:O8MEFphYvjCxB5L0TDumsVwcUtgFpBhogFgnMAsFRGYdNwjwHaVOjl:NMAuuxS2wcNFZ+se6XHf |
| MD5: | 2E866FA1BAA934603BA81970DCE1EB6A |
| SHA1: | 3A4FC2B5AA84CEE97EA7221D80A5FDE2B81EC55E |
| SHA-256: | 0FFC6DE979B76D9DD2030634E75F779053C15FD8CC6AC6AA8440E6DF47CBB256 |
| SHA-512: | E249C2DF47DA69FCCBD249DFC933DF76E2440895470195936A05930A9127BA680096D9089722B202E8F793A2F38A4118149424FB2474E4B21EFE4DA284A97483 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Hvirvelstroemmen\Emalje.kap
Download File
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 161977 |
| Entropy (8bit): | 1.2465706431701635 |
| Encrypted: | false |
| SSDEEP: | 768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo |
| MD5: | 818D9B577C6A2CCB8C8D753C89B0AEED |
| SHA1: | 1912E60E75B47E0AC0B0ACDB2B320F0B36D3CE22 |
| SHA-256: | B53DFB245A8D5A0F0FAEEC7E8B4AE273522AC29FD29B33608F9BA7F9ADB90279 |
| SHA-512: | 91993AA2E3E2666A3945886101B2B670CD3B0D76CF3CFFF3684DCB310FE324A1C650FAB5D5D00B8CFA49B5A7713FE2DBBA6DC2D8BB8DAC7A169495E6694CE4C6 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Hvirvelstroemmen\Retaker.Vig 
Download File
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 270501 |
| Entropy (8bit): | 7.794799906911965 |
| Encrypted: | false |
| SSDEEP: | 6144:T9uzfmzNr60QfyeUgGOl2k9CJkcNSb9dpaD8:T9MmJm3qob5aD8 |
| MD5: | E1887E10F7CBF33ACE70F1354DE28D25 |
| SHA1: | 9010A838A3266A116C4B6D49698E17660456CE35 |
| SHA-256: | 99F51863D0A73733A695B427BB31ED3D95CA60CBF340AA2B7B09DBAEB8016BD4 |
| SHA-512: | 2A2BBFB857D579A7A8679EE6E00A15E7D7657ACEF55104B614D83C6030FF257279C144AE7ECC2DD681A3A08E23E36D01296FBD156C74F0F615425CE4EC1C64BB |
| Malicious: | true |
| Yara Hits: |
|
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Hvirvelstroemmen\img2.jpg
Download File
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2929 |
| Entropy (8bit): | 7.418910042244289 |
| Encrypted: | false |
| SSDEEP: | 48:j2XBhBOaFxHfEaq1kk1YunCRbvwxhjAxnyHIvR4SnHP7oNLpLR8Fqhr:j2XBv9Fx2kkO7RihjlovpnHPCpaQ1 |
| MD5: | 49DAF4E74443D8502F3229468615185F |
| SHA1: | 9BB41BF5F382EE315893366F559FA26D57A4CD5F |
| SHA-256: | E5EE495A89E55467DB6A396F012EDB6A71D2E762CFC7FC6846FE7259528BF168 |
| SHA-512: | EE9ABC6A19215FED64584BA24736ECBA24139CD03A75530FF351C99A25628410472A28F4EE08E87CE1F75DC79396A2A9C1AC79C399720C320437BC18993B561A |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Hvirvelstroemmen\pinrail.whe
Download File
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 461378 |
| Entropy (8bit): | 1.252059381950645 |
| Encrypted: | false |
| SSDEEP: | 1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76 |
| MD5: | 3AD2FE4EA13486258EADDD1E5940A6D7 |
| SHA1: | 06D0468A125D754D4534C182D79444DFB7A1CF61 |
| SHA-256: | E4C5F20595C446D20C978CF7B486579BA2FFC17E64B940733B40C89DF4331319 |
| SHA-512: | 82328E01492BDB8B23555CB369279A5352B35E0B51A4A4AC88D9F9285BBDABA627FE01139B4F9669847252D5A59FC512B2463A364EFD5C33B83309D6A8985D59 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Hvirvelstroemmen\unyouthfully.ske
Download File
| Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 225641 |
| Entropy (8bit): | 1.2362366155163755 |
| Encrypted: | false |
| SSDEEP: | 768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h |
| MD5: | 94C4B93474D07658FCBD411A20E68532 |
| SHA1: | 66421117EB902B48D39A1514C88C868394085FCF |
| SHA-256: | 50B1D7356F0CC22F2A9AE93A7CC9738C6BC0907724ACDB85F68F594333B706DC |
| SHA-512: | BC1C40FF5B9FD71590E9B3E71D7B58A46E8AFBE56DFBD22C39F5DC0952ACEDC96F2BC4D8428EA0BCD75D67BD32F2B095585925CD8141063801FB128EA46F7471 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.106102869106372 |
| TrID: |
|
| File name: | Bank Swift and SOA PRN0072003410853_pdf.exe |
| File size: | 755'273 bytes |
| MD5: | eb15bbefe683ef09c1c5c1bf5068dd71 |
| SHA1: | 0b613412103c088372fb19656152d21d6a5db027 |
| SHA256: | 8250c1a738d87ed5e8f7d743fa4b523a8c662c568f97b05de5712e9f2c39c647 |
| SHA512: | efc5e6c51a7d815294bf6de694803165c7e56e456e1cf350539e0299f66af3d5dc346bd5d98df151f51ee4fd35dccad98a113d22354f6cae4cbf0d31d823c45f |
| SSDEEP: | 12288:xlYZmcRHOys4LnDPb/RNXcIYSBZZKS2vHll7Q9hSCjJgroHaPdl7Fh:UmcdOt4LrXcAvKSErsOk+rddd3 |
| TLSH: | 82F4E05F570B8406EEA414F2B8A3DE43A5F9BFBC112973455D62FE1B80B3B70394A189 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*ju.*j..ujw.*ju.+j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L.....oS.................`...*......Z3.......p....@ |
 | |
| Icon Hash: | 058cc0e474936126 |
| Entrypoint: | 0x40335a |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x536FD79B [Sun May 11 20:03:39 2014 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | e221f4f7d36469d53810a4b5f9fc8966 |
| Instruction |
|---|
| sub esp, 000002D4h |
| push ebx |
| push ebp |
| push esi |
| push edi |
| push 00000020h |
| xor ebp, ebp |
| pop esi |
| mov dword ptr [esp+14h], ebp |
| mov dword ptr [esp+10h], 00409230h |
| mov dword ptr [esp+1Ch], ebp |
| call dword ptr [00407034h] |
| push 00008001h |
| call dword ptr [004070BCh] |
| push ebp |
| call dword ptr [004072ACh] |
| push 00000008h |
| mov dword ptr [00429298h], eax |
| call 00007F122C83689Ch |
| mov dword ptr [004291E4h], eax |
| push ebp |
| lea eax, dword ptr [esp+34h] |
| push 000002B4h |
| push eax |
| push ebp |
| push 00420690h |
| call dword ptr [0040717Ch] |
| push 0040937Ch |
| push 004281E0h |
| call 00007F122C836507h |
| call dword ptr [00407134h] |
| mov ebx, 00434000h |
| push eax |
| push ebx |
| call 00007F122C8364F5h |
| push ebp |
| call dword ptr [0040710Ch] |
| cmp word ptr [00434000h], 0022h |
| mov dword ptr [004291E0h], eax |
| mov eax, ebx |
| jne 00007F122C8339EAh |
| push 00000022h |
| mov eax, 00434002h |
| pop esi |
| push esi |
| push eax |
| call 00007F122C835F46h |
| push eax |
| call dword ptr [00407240h] |
| mov dword ptr [esp+18h], eax |
| jmp 00007F122C833AAEh |
| push 00000020h |
| pop edx |
| cmp cx, dx |
| jne 00007F122C8339E9h |
| inc eax |
| inc eax |
| cmp word ptr [eax], dx |
| je 00007F122C8339DBh |
| add word ptr [eax], 0000h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7494 | 0xb4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x5f000 | 0x43188 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x2b8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5e68 | 0x6000 | 2f6554958e1a5093777de617d6e0bffc | False | 0.6566162109375 | data | 6.419811957742583 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x7000 | 0x1354 | 0x1400 | 2222fe44ebbadbc32af32dfc9c88e48e | False | 0.4306640625 | data | 5.037511188789184 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x9000 | 0x202d8 | 0x600 | 9587277f9a9b39e2caf86eae07909d87 | False | 0.4733072916666667 | data | 3.757932017065988 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x2a000 | 0x35000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x5f000 | 0x43188 | 0x43200 | ad79ab7bc0418c21ba04b90eb50d4a0c | False | 0.18500494646182494 | data | 4.605797713668011 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_BITMAP | 0x5f2b0 | 0x368 | Device independent bitmap graphic, 96 x 16 x 4, image size 768 | English | United States | 0.23623853211009174 |
| RT_ICON | 0x5f618 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 270336 | English | United States | 0.1810552711779152 |
| RT_DIALOG | 0xa1640 | 0x144 | data | English | United States | 0.5216049382716049 |
| RT_DIALOG | 0xa1788 | 0x13c | data | English | United States | 0.5506329113924051 |
| RT_DIALOG | 0xa18c8 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0xa19c8 | 0x11c | data | English | United States | 0.6091549295774648 |
| RT_DIALOG | 0xa1ae8 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0xa1bb0 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0xa1c10 | 0x14 | data | English | United States | 1.1 |
| RT_VERSION | 0xa1c28 | 0x258 | data | English | United States | 0.5216666666666666 |
| RT_MANIFEST | 0xa1e80 | 0x305 | XML 1.0 document, ASCII text, with very long lines (773), with no line terminators | English | United States | 0.5614489003880984 |
| DLL | Import |
|---|---|
| KERNEL32.dll | CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte |
| USER32.dll | EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW |
| ADVAPI32.dll | RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW |
| COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
| ole32.dll | CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize |
| VERSION.dll | GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-04T11:10:26.346082+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.5 | 49726 | 172.217.19.174 | 443 | TCP |
| 2024-12-04T11:10:34.869877+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.5 | 49748 | 132.226.8.169 | 80 | TCP |
| 2024-12-04T11:10:44.338662+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.5 | 49748 | 132.226.8.169 | 80 | TCP |
| 2024-12-04T11:10:46.518416+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49779 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:10:48.651116+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.5 | 49785 | 132.226.8.169 | 80 | TCP |
| 2024-12-04T11:10:50.615411+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49790 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:10:54.265274+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49799 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:10:57.897097+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49810 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:01.583875+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49821 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:05.271299+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49830 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:08.882443+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49842 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:12.467151+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49851 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:16.359602+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49861 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:20.031781+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49873 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:23.745606+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49883 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:28.276507+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49895 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:32.738827+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49909 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:36.637819+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49918 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:40.704591+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49929 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:44.432301+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49939 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:48.168639+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49948 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:51.977951+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49959 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:55.740334+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49970 | 149.154.167.220 | 443 | TCP |
| 2024-12-04T11:11:59.303616+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49980 | 149.154.167.220 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 4, 2024 11:10:23.686027050 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:23.686055899 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:23.686182976 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:23.697618961 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:23.697630882 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:25.439162016 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:25.439332008 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:25.439846039 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:25.439944029 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:25.486697912 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:25.486716986 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:25.486944914 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:25.486998081 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:25.489097118 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:25.535330057 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:26.346093893 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:26.346184015 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:26.346193075 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:26.346229076 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:26.346420050 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:26.346446991 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:26.346592903 CET | 443 | 49726 | 172.217.19.174 | 192.168.2.5 |
| Dec 4, 2024 11:10:26.346637964 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:26.346653938 CET | 49726 | 443 | 192.168.2.5 | 172.217.19.174 |
| Dec 4, 2024 11:10:26.497376919 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:26.497416019 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:26.497510910 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:26.497898102 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:26.497909069 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:28.196178913 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:28.196393013 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:28.201262951 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:28.201278925 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:28.201503038 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:28.201551914 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:28.210783958 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:28.255331039 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.004369974 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.004488945 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.017532110 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.017600060 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.124644995 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.124775887 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.128614902 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.132090092 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.132100105 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.135508060 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.195761919 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.196115971 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.199565887 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.199640036 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.199726105 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.199765921 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.205512047 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.205554962 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.215195894 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.215251923 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.216057062 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.216100931 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.222347975 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.222393990 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.226389885 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.226438999 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.231549025 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.231602907 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.240159988 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.240214109 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.243959904 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.244016886 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.253823042 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.253890038 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.256803989 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.256863117 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.267795086 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.267853975 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.270900011 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.270960093 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.281166077 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.281238079 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.284444094 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.284498930 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.295095921 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.295159101 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.298506021 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.298568010 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.308717012 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.308803082 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.311825991 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.311883926 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.322499990 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.322563887 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.322643042 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.322691917 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.336251020 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.336319923 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.361845970 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.361901045 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.361967087 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.362020969 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.389374018 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.389437914 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.389528990 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.389571905 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.391535997 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.391588926 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.395751953 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.395802975 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.395869017 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.395915985 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.399633884 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.399688959 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.399818897 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.399882078 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.410942078 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.411026001 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.411036968 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.411078930 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.411106110 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.411150932 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.421843052 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.421963930 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.421972990 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.422019958 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.432543039 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.432636976 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.432670116 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.432719946 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.442704916 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.442806005 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.442859888 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.442956924 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.452771902 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.452838898 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.452912092 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.452958107 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.463068962 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.463145018 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.463156939 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.463197947 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.472973108 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.473052979 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.473176956 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.473218918 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.483010054 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.483088970 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.483143091 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.483185053 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.493208885 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.493275881 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.493285894 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.493335009 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.502818108 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.502882004 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.502892971 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.502924919 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.511885881 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.511969090 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.512042999 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.512092113 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.520967960 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.521029949 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.521066904 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.521106005 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.529767036 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.529833078 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.529988050 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.530030012 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.530034065 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.530075073 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.531094074 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.531140089 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.531177998 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:31.531208992 CET | 443 | 49737 | 142.250.181.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:31.531255960 CET | 49737 | 443 | 192.168.2.5 | 142.250.181.1 |
| Dec 4, 2024 11:10:32.704644918 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:32.824801922 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:32.824911118 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:32.825270891 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:32.945333004 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:34.315256119 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:34.320499897 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:34.440455914 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:34.817867994 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:34.869877100 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:35.633755922 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:35.633809090 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:35.633883953 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:35.636609077 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:35.636620045 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:36.862801075 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:36.862893105 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:36.867712975 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:36.867722988 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:36.868194103 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:36.873078108 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:36.915338039 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:37.300746918 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:37.300940990 CET | 443 | 49759 | 104.21.67.152 | 192.168.2.5 |
| Dec 4, 2024 11:10:37.301002026 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:37.307065010 CET | 49759 | 443 | 192.168.2.5 | 104.21.67.152 |
| Dec 4, 2024 11:10:42.783827066 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:42.904381037 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:44.296890020 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:44.338661909 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:44.440315962 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:44.440376043 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:44.440447092 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:44.441138029 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:44.441149950 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:45.858066082 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:45.858133078 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:45.861152887 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:45.861164093 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:45.861418962 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:45.864172935 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:45.907335997 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:45.907386065 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:45.907393932 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:46.518431902 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:46.518826962 CET | 443 | 49779 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:46.518902063 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:46.519499063 CET | 49779 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:46.694468975 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:46.695750952 CET | 49785 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:46.816031933 CET | 80 | 49748 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:46.816102982 CET | 49748 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:46.816112995 CET | 80 | 49785 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:46.816190958 CET | 49785 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:46.816401958 CET | 49785 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:46.936376095 CET | 80 | 49785 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:48.610369921 CET | 80 | 49785 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:48.611682892 CET | 49790 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:48.611713886 CET | 443 | 49790 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:48.611797094 CET | 49790 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:48.612456083 CET | 49790 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:48.612469912 CET | 443 | 49790 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:48.651115894 CET | 49785 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:49.984677076 CET | 443 | 49790 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:49.986430883 CET | 49790 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:49.986447096 CET | 443 | 49790 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:49.986516953 CET | 49790 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:49.986522913 CET | 443 | 49790 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:50.615489006 CET | 443 | 49790 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:50.615580082 CET | 443 | 49790 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:50.615668058 CET | 49790 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:50.616250992 CET | 49790 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:50.621022940 CET | 49794 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:50.741023064 CET | 80 | 49794 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:50.741110086 CET | 49794 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:50.741425037 CET | 49794 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:50.861562014 CET | 80 | 49794 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:52.236200094 CET | 80 | 49794 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:52.237693071 CET | 49799 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:52.237724066 CET | 443 | 49799 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:52.237817049 CET | 49799 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:52.238123894 CET | 49799 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:52.238137007 CET | 443 | 49799 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:52.276254892 CET | 49794 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:53.602243900 CET | 443 | 49799 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:53.604516983 CET | 49799 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:53.604561090 CET | 443 | 49799 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:53.604651928 CET | 49799 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:53.604659081 CET | 443 | 49799 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:54.265342951 CET | 443 | 49799 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:54.265430927 CET | 443 | 49799 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:54.265486956 CET | 49799 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:54.265938044 CET | 49799 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:54.269531965 CET | 49794 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:54.270503998 CET | 49804 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:54.390054941 CET | 80 | 49794 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:54.390192986 CET | 49794 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:54.390454054 CET | 80 | 49804 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:54.390527964 CET | 49804 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:54.390705109 CET | 49804 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:54.510575056 CET | 80 | 49804 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:55.838268042 CET | 80 | 49804 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:55.839746952 CET | 49810 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:55.839790106 CET | 443 | 49810 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:55.839869976 CET | 49810 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:55.840212107 CET | 49810 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:55.840228081 CET | 443 | 49810 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:55.885476112 CET | 49804 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:57.255714893 CET | 443 | 49810 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:57.257283926 CET | 49810 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:57.257314920 CET | 443 | 49810 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:57.257365942 CET | 49810 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:57.257373095 CET | 443 | 49810 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:57.897165060 CET | 443 | 49810 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:57.897257090 CET | 443 | 49810 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:57.897311926 CET | 49810 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:57.897892952 CET | 49810 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:57.901787996 CET | 49804 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:57.903088093 CET | 49817 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:58.021984100 CET | 80 | 49804 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:58.022092104 CET | 49804 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:58.023216009 CET | 80 | 49817 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:58.023294926 CET | 49817 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:58.023503065 CET | 49817 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:10:58.143430948 CET | 80 | 49817 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:59.521495104 CET | 80 | 49817 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:10:59.522855043 CET | 49821 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:59.522916079 CET | 443 | 49821 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:59.523000002 CET | 49821 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:59.523263931 CET | 49821 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:10:59.523278952 CET | 443 | 49821 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:10:59.572961092 CET | 49817 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:00.931529999 CET | 443 | 49821 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:00.956924915 CET | 49821 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:00.956940889 CET | 443 | 49821 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:00.957005978 CET | 49821 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:00.957015038 CET | 443 | 49821 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:01.583934069 CET | 443 | 49821 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:01.584028006 CET | 443 | 49821 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:01.584110975 CET | 49821 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:01.584656000 CET | 49821 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:01.587888002 CET | 49817 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:01.589319944 CET | 49826 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:01.708291054 CET | 80 | 49817 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:01.708342075 CET | 49817 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:01.709233999 CET | 80 | 49826 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:01.709286928 CET | 49826 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:01.709464073 CET | 49826 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:01.829340935 CET | 80 | 49826 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:03.174751043 CET | 80 | 49826 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:03.179409981 CET | 49830 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:03.179441929 CET | 443 | 49830 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:03.179536104 CET | 49830 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:03.179835081 CET | 49830 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:03.179847956 CET | 443 | 49830 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:03.229232073 CET | 49826 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:04.540965080 CET | 443 | 49830 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:04.556931019 CET | 49830 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:04.556982994 CET | 443 | 49830 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:04.557046890 CET | 49830 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:04.557056904 CET | 443 | 49830 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:05.271368027 CET | 443 | 49830 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:05.271457911 CET | 443 | 49830 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:05.271522045 CET | 49830 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:05.272061110 CET | 49830 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:05.275342941 CET | 49826 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:05.276485920 CET | 49836 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:05.395571947 CET | 80 | 49826 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:05.395646095 CET | 49826 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:05.396445990 CET | 80 | 49836 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:05.396605015 CET | 49836 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:05.396682024 CET | 49836 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:05.516561031 CET | 80 | 49836 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:06.880300045 CET | 80 | 49836 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:06.881568909 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:06.881608963 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:06.881689072 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:06.882014990 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:06.882031918 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:06.932492971 CET | 49836 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:08.251799107 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:08.253552914 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:08.253623962 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:08.253688097 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:08.253700018 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:08.882595062 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:08.882834911 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:08.882900953 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:08.883249998 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:08.887156963 CET | 49836 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:08.888257027 CET | 49848 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:09.008742094 CET | 80 | 49848 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:09.008865118 CET | 49848 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:09.009104013 CET | 49848 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:09.009689093 CET | 80 | 49836 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:09.009764910 CET | 49836 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:09.129085064 CET | 80 | 49848 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:10.452987909 CET | 80 | 49848 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:10.454080105 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:10.454134941 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:10.454204082 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:10.454483986 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:10.454498053 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:10.494864941 CET | 49848 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:11.842194080 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:11.843940020 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:11.843972921 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:11.844024897 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:11.844034910 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:12.467180014 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:12.467381954 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:12.467473984 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:12.468074083 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:12.473484993 CET | 49848 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:12.474117994 CET | 49857 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:12.594257116 CET | 80 | 49848 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:12.594299078 CET | 80 | 49857 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:12.594372988 CET | 49848 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:12.594441891 CET | 49857 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:12.634440899 CET | 49857 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:12.754492998 CET | 80 | 49857 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:14.228383064 CET | 80 | 49857 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:14.229904890 CET | 49861 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:14.229949951 CET | 443 | 49861 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:14.230031013 CET | 49861 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:14.230334997 CET | 49861 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:14.230345011 CET | 443 | 49861 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:14.276087999 CET | 49857 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:15.655936956 CET | 443 | 49861 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:15.693506956 CET | 49861 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:15.693530083 CET | 443 | 49861 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:15.693612099 CET | 49861 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:15.693622112 CET | 443 | 49861 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:16.359635115 CET | 443 | 49861 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:16.361062050 CET | 443 | 49861 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:16.364131927 CET | 49861 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:16.364501953 CET | 49861 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:16.367640972 CET | 49857 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:16.368711948 CET | 49867 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:16.487907887 CET | 80 | 49857 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:16.488154888 CET | 49857 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:16.488603115 CET | 80 | 49867 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:16.488683939 CET | 49867 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:16.488867998 CET | 49867 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:16.608855009 CET | 80 | 49867 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:17.989159107 CET | 80 | 49867 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:17.991291046 CET | 49873 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:17.991343975 CET | 443 | 49873 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:17.991406918 CET | 49873 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:17.991913080 CET | 49873 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:17.991928101 CET | 443 | 49873 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:18.041692972 CET | 49867 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:19.369036913 CET | 443 | 49873 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:19.370783091 CET | 49873 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:19.370815039 CET | 443 | 49873 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:19.370884895 CET | 49873 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:19.370891094 CET | 443 | 49873 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:20.031857014 CET | 443 | 49873 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:20.031954050 CET | 443 | 49873 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:20.032021999 CET | 49873 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:20.032581091 CET | 49873 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:20.035550117 CET | 49867 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:20.036566019 CET | 49879 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:20.155884981 CET | 80 | 49867 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:20.156117916 CET | 49867 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:20.156476021 CET | 80 | 49879 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:20.160130978 CET | 49879 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:20.160295010 CET | 49879 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:20.280235052 CET | 80 | 49879 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:21.601846933 CET | 80 | 49879 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:21.603220940 CET | 49883 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:21.603250027 CET | 443 | 49883 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:21.603321075 CET | 49883 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:21.603674889 CET | 49883 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:21.603684902 CET | 443 | 49883 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:21.651180983 CET | 49879 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:23.018384933 CET | 443 | 49883 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:23.023839951 CET | 49883 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:23.023861885 CET | 443 | 49883 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:23.024010897 CET | 49883 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:23.024014950 CET | 443 | 49883 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:23.745687008 CET | 443 | 49883 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:23.745778084 CET | 443 | 49883 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:23.745822906 CET | 49883 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:23.746284962 CET | 49883 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:23.749746084 CET | 49879 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:23.750829935 CET | 49889 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:23.870989084 CET | 80 | 49889 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:23.871079922 CET | 49889 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:23.871275902 CET | 49889 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:23.884035110 CET | 80 | 49879 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:23.884100914 CET | 49879 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:23.991216898 CET | 80 | 49889 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:26.037928104 CET | 80 | 49889 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:26.039398909 CET | 49895 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:26.039455891 CET | 443 | 49895 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:26.039521933 CET | 49895 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:26.039839029 CET | 49895 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:26.039855003 CET | 443 | 49895 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:26.088617086 CET | 49889 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:27.399374962 CET | 443 | 49895 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:27.401360989 CET | 49895 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:27.401386976 CET | 443 | 49895 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:27.401449919 CET | 49895 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:27.401457071 CET | 443 | 49895 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:28.276556969 CET | 443 | 49895 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:28.276654005 CET | 443 | 49895 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:28.276709080 CET | 49895 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:28.277170897 CET | 49895 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:28.280648947 CET | 49889 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:28.281862974 CET | 49901 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:28.401747942 CET | 80 | 49889 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:28.401802063 CET | 49889 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:28.402329922 CET | 80 | 49901 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:28.402399063 CET | 49901 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:28.402584076 CET | 49901 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:28.522526026 CET | 80 | 49901 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:30.685756922 CET | 80 | 49901 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:30.687589884 CET | 49909 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:30.687629938 CET | 443 | 49909 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:30.687720060 CET | 49909 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:30.687969923 CET | 49909 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:30.687982082 CET | 443 | 49909 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:30.729199886 CET | 49901 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:32.095814943 CET | 443 | 49909 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:32.097393990 CET | 49909 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:32.097409964 CET | 443 | 49909 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:32.097464085 CET | 49909 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:32.097470999 CET | 443 | 49909 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:32.738853931 CET | 443 | 49909 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:32.738982916 CET | 443 | 49909 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:32.739028931 CET | 49909 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:32.739363909 CET | 49909 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:32.742367029 CET | 49901 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:32.743590117 CET | 49914 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:32.862946033 CET | 80 | 49901 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:32.863038063 CET | 49901 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:32.863559961 CET | 80 | 49914 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:32.863625050 CET | 49914 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:32.863785982 CET | 49914 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:32.983707905 CET | 80 | 49914 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:34.584023952 CET | 80 | 49914 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:34.585521936 CET | 49918 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:34.585565090 CET | 443 | 49918 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:34.585681915 CET | 49918 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:34.585947990 CET | 49918 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:34.585963964 CET | 443 | 49918 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:34.635445118 CET | 49914 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:35.953603029 CET | 443 | 49918 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:35.955368996 CET | 49918 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:35.955404997 CET | 443 | 49918 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:35.955481052 CET | 49918 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:35.955487967 CET | 443 | 49918 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:36.637871981 CET | 443 | 49918 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:36.637948990 CET | 443 | 49918 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:36.638019085 CET | 49918 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:36.639451027 CET | 49918 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:36.644009113 CET | 49914 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:36.644804001 CET | 49924 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:36.764259100 CET | 80 | 49914 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:36.768030882 CET | 80 | 49924 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:36.768098116 CET | 49914 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:36.768145084 CET | 49924 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:36.768341064 CET | 49924 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:36.889477015 CET | 80 | 49924 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:38.621478081 CET | 80 | 49924 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:38.625452995 CET | 49929 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:38.625503063 CET | 443 | 49929 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:38.625575066 CET | 49929 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:38.625869989 CET | 49929 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:38.625890017 CET | 443 | 49929 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:38.666753054 CET | 49924 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:39.991296053 CET | 443 | 49929 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:39.992968082 CET | 49929 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:39.992983103 CET | 443 | 49929 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:39.993031025 CET | 49929 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:39.993037939 CET | 443 | 49929 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:40.704688072 CET | 443 | 49929 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:40.704783916 CET | 443 | 49929 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:40.704839945 CET | 49929 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:40.705312014 CET | 49929 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:40.708182096 CET | 49924 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:40.709274054 CET | 49934 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:40.828340054 CET | 80 | 49924 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:40.829248905 CET | 80 | 49934 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:40.829319954 CET | 49924 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:40.829359055 CET | 49934 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:40.829516888 CET | 49934 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:40.949537039 CET | 80 | 49934 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:42.251863956 CET | 80 | 49934 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:42.253134012 CET | 49939 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:42.253196955 CET | 443 | 49939 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:42.253281116 CET | 49939 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:42.253598928 CET | 49939 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:42.253614902 CET | 443 | 49939 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:42.307332039 CET | 49934 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:43.776936054 CET | 443 | 49939 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:43.778542042 CET | 49939 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:43.778563976 CET | 443 | 49939 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:43.778620005 CET | 49939 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:43.778636932 CET | 443 | 49939 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:44.432343006 CET | 443 | 49939 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:44.432409048 CET | 443 | 49939 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:44.432492018 CET | 49939 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:44.432955980 CET | 49939 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:44.436089039 CET | 49934 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:44.437297106 CET | 49945 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:44.556350946 CET | 80 | 49934 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:44.556468964 CET | 49934 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:44.557230949 CET | 80 | 49945 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:44.557358027 CET | 49945 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:44.557605028 CET | 49945 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:44.677645922 CET | 80 | 49945 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:46.043138981 CET | 80 | 49945 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:46.044567108 CET | 49948 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:46.044599056 CET | 443 | 49948 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:46.044680119 CET | 49948 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:46.045089960 CET | 49948 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:46.045099974 CET | 443 | 49948 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:46.088593960 CET | 49945 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:47.455764055 CET | 443 | 49948 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:47.457612038 CET | 49948 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:47.457629919 CET | 443 | 49948 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:47.457686901 CET | 49948 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:47.457699060 CET | 443 | 49948 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:48.168708086 CET | 443 | 49948 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:48.168795109 CET | 443 | 49948 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:48.168847084 CET | 49948 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:48.169243097 CET | 49948 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:48.172344923 CET | 49945 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:48.173345089 CET | 49954 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:48.293530941 CET | 80 | 49945 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:48.293587923 CET | 49945 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:48.293618917 CET | 80 | 49954 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:48.293683052 CET | 49954 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:48.293854952 CET | 49954 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:48.413706064 CET | 80 | 49954 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:49.783677101 CET | 80 | 49954 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:49.785296917 CET | 49959 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:49.785331964 CET | 443 | 49959 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:49.785501003 CET | 49959 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:49.785670996 CET | 49959 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:49.785690069 CET | 443 | 49959 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:49.838689089 CET | 49954 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:51.195471048 CET | 443 | 49959 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:51.197083950 CET | 49959 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:51.197103977 CET | 443 | 49959 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:51.197163105 CET | 49959 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:51.197174072 CET | 443 | 49959 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:51.978038073 CET | 443 | 49959 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:51.978128910 CET | 443 | 49959 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:51.978177071 CET | 49959 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:51.978585005 CET | 49959 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:52.046875954 CET | 49954 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:52.047641993 CET | 49965 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:52.167212009 CET | 80 | 49954 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:52.167527914 CET | 80 | 49965 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:52.167623043 CET | 49954 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:52.167654037 CET | 49965 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:52.175640106 CET | 49965 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:52.295614004 CET | 80 | 49965 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:53.614816904 CET | 80 | 49785 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:53.616200924 CET | 49785 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:53.630099058 CET | 80 | 49965 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:53.631546021 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:53.631588936 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:53.631669044 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:53.631994963 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:53.632013083 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:53.682317019 CET | 49965 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:55.004519939 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:55.033226967 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:55.033256054 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:55.033312082 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:55.033320904 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:55.740395069 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:55.740490913 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:55.740612030 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:55.741106033 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:55.743892908 CET | 49965 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:55.745289087 CET | 49976 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:55.864063025 CET | 80 | 49965 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:55.865068913 CET | 49965 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:55.865269899 CET | 80 | 49976 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:55.865345001 CET | 49976 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:55.865509987 CET | 49976 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:55.985379934 CET | 80 | 49976 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:57.297154903 CET | 80 | 49976 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:57.301366091 CET | 49980 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:57.301429987 CET | 443 | 49980 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:57.301506996 CET | 49980 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:57.301846981 CET | 49980 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:57.301863909 CET | 443 | 49980 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:57.354182959 CET | 49976 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:58.671178102 CET | 443 | 49980 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:58.675909042 CET | 49980 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:58.675940990 CET | 443 | 49980 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:58.676000118 CET | 49980 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:58.676013947 CET | 443 | 49980 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:59.303677082 CET | 443 | 49980 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:59.303754091 CET | 443 | 49980 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:11:59.303841114 CET | 49980 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:59.304323912 CET | 49980 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:11:59.307974100 CET | 49976 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:59.309216022 CET | 49986 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:59.428308010 CET | 80 | 49976 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:59.428541899 CET | 49976 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:59.429240942 CET | 80 | 49986 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:11:59.429326057 CET | 49986 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:59.429467916 CET | 49986 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:11:59.549343109 CET | 80 | 49986 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:12:00.881520033 CET | 80 | 49986 | 132.226.8.169 | 192.168.2.5 |
| Dec 4, 2024 11:12:00.932343006 CET | 49986 | 80 | 192.168.2.5 | 132.226.8.169 |
| Dec 4, 2024 11:12:02.377954960 CET | 49993 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:12:02.378004074 CET | 443 | 49993 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:12:02.378082037 CET | 49993 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:12:02.378505945 CET | 49993 | 443 | 192.168.2.5 | 149.154.167.220 |
| Dec 4, 2024 11:12:02.378524065 CET | 443 | 49993 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:12:03.785726070 CET | 443 | 49993 | 149.154.167.220 | 192.168.2.5 |
| Dec 4, 2024 11:12:03.838565111 CET | 49993 | 443 | 192.168.2.5 | 149.154.167.220 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 4, 2024 11:10:23.542798996 CET | 54893 | 53 | 192.168.2.5 | 1.1.1.1 |
| Dec 4, 2024 11:10:23.680083036 CET | 53 | 54893 | 1.1.1.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:26.358203888 CET | 60967 | 53 | 192.168.2.5 | 1.1.1.1 |
| Dec 4, 2024 11:10:26.496289968 CET | 53 | 60967 | 1.1.1.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:32.385504007 CET | 51926 | 53 | 192.168.2.5 | 1.1.1.1 |
| Dec 4, 2024 11:10:32.531820059 CET | 53 | 51926 | 1.1.1.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:35.172769070 CET | 61644 | 53 | 192.168.2.5 | 1.1.1.1 |
| Dec 4, 2024 11:10:35.632683992 CET | 53 | 61644 | 1.1.1.1 | 192.168.2.5 |
| Dec 4, 2024 11:10:44.301074982 CET | 63498 | 53 | 192.168.2.5 | 1.1.1.1 |
| Dec 4, 2024 11:10:44.439358950 CET | 53 | 63498 | 1.1.1.1 | 192.168.2.5 |
| Dec 4, 2024 11:12:02.238836050 CET | 56235 | 53 | 192.168.2.5 | 1.1.1.1 |
| Dec 4, 2024 11:12:02.377077103 CET | 53 | 56235 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 4, 2024 11:10:23.542798996 CET | 192.168.2.5 | 1.1.1.1 | 0x2536 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 4, 2024 11:10:26.358203888 CET | 192.168.2.5 | 1.1.1.1 | 0x289b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 4, 2024 11:10:32.385504007 CET | 192.168.2.5 | 1.1.1.1 | 0xc7e4 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 4, 2024 11:10:35.172769070 CET | 192.168.2.5 | 1.1.1.1 | 0xa90c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 4, 2024 11:10:44.301074982 CET | 192.168.2.5 | 1.1.1.1 | 0xe64b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 4, 2024 11:12:02.238836050 CET | 192.168.2.5 | 1.1.1.1 | 0x53f3 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 4, 2024 11:10:23.680083036 CET | 1.1.1.1 | 192.168.2.5 | 0x2536 | No error (0) | 172.217.19.174 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:26.496289968 CET | 1.1.1.1 | 192.168.2.5 | 0x289b | No error (0) | 142.250.181.1 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:32.531820059 CET | 1.1.1.1 | 192.168.2.5 | 0xc7e4 | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:32.531820059 CET | 1.1.1.1 | 192.168.2.5 | 0xc7e4 | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:32.531820059 CET | 1.1.1.1 | 192.168.2.5 | 0xc7e4 | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:32.531820059 CET | 1.1.1.1 | 192.168.2.5 | 0xc7e4 | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:32.531820059 CET | 1.1.1.1 | 192.168.2.5 | 0xc7e4 | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:32.531820059 CET | 1.1.1.1 | 192.168.2.5 | 0xc7e4 | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:35.632683992 CET | 1.1.1.1 | 192.168.2.5 | 0xa90c | No error (0) | 104.21.67.152 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:35.632683992 CET | 1.1.1.1 | 192.168.2.5 | 0xa90c | No error (0) | 172.67.177.134 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:10:44.439358950 CET | 1.1.1.1 | 192.168.2.5 | 0xe64b | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false | ||
| Dec 4, 2024 11:12:02.377077103 CET | 1.1.1.1 | 192.168.2.5 | 0x53f3 | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49748 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:10:32.825270891 CET | 151 | OUT | |
| Dec 4, 2024 11:10:34.315256119 CET | 273 | IN | |
| Dec 4, 2024 11:10:34.320499897 CET | 127 | OUT | |
| Dec 4, 2024 11:10:34.817867994 CET | 273 | IN | |
| Dec 4, 2024 11:10:42.783827066 CET | 127 | OUT | |
| Dec 4, 2024 11:10:44.296890020 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49785 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:10:46.816401958 CET | 127 | OUT | |
| Dec 4, 2024 11:10:48.610369921 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.5 | 49794 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:10:50.741425037 CET | 151 | OUT | |
| Dec 4, 2024 11:10:52.236200094 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.5 | 49804 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:10:54.390705109 CET | 151 | OUT | |
| Dec 4, 2024 11:10:55.838268042 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.5 | 49817 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:10:58.023503065 CET | 151 | OUT | |
| Dec 4, 2024 11:10:59.521495104 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.5 | 49826 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:01.709464073 CET | 151 | OUT | |
| Dec 4, 2024 11:11:03.174751043 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.5 | 49836 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:05.396682024 CET | 151 | OUT | |
| Dec 4, 2024 11:11:06.880300045 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.5 | 49848 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:09.009104013 CET | 151 | OUT | |
| Dec 4, 2024 11:11:10.452987909 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.5 | 49857 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:12.634440899 CET | 151 | OUT | |
| Dec 4, 2024 11:11:14.228383064 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.5 | 49867 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:16.488867998 CET | 151 | OUT | |
| Dec 4, 2024 11:11:17.989159107 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.5 | 49879 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:20.160295010 CET | 151 | OUT | |
| Dec 4, 2024 11:11:21.601846933 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.5 | 49889 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:23.871275902 CET | 151 | OUT | |
| Dec 4, 2024 11:11:26.037928104 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.5 | 49901 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:28.402584076 CET | 151 | OUT | |
| Dec 4, 2024 11:11:30.685756922 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.5 | 49914 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:32.863785982 CET | 151 | OUT | |
| Dec 4, 2024 11:11:34.584023952 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.5 | 49924 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:36.768341064 CET | 151 | OUT | |
| Dec 4, 2024 11:11:38.621478081 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.5 | 49934 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:40.829516888 CET | 151 | OUT | |
| Dec 4, 2024 11:11:42.251863956 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.5 | 49945 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:44.557605028 CET | 151 | OUT | |
| Dec 4, 2024 11:11:46.043138981 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.5 | 49954 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:48.293854952 CET | 151 | OUT | |
| Dec 4, 2024 11:11:49.783677101 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.5 | 49965 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:52.175640106 CET | 151 | OUT | |
| Dec 4, 2024 11:11:53.630099058 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.5 | 49976 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:55.865509987 CET | 151 | OUT | |
| Dec 4, 2024 11:11:57.297154903 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.5 | 49986 | 132.226.8.169 | 80 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 4, 2024 11:11:59.429467916 CET | 151 | OUT | |
| Dec 4, 2024 11:12:00.881520033 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49726 | 172.217.19.174 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:10:25 UTC | 216 | OUT | |
| 2024-12-04 10:10:26 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49737 | 142.250.181.1 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:10:28 UTC | 258 | OUT | |
| 2024-12-04 10:10:31 UTC | 4928 | IN | |
| 2024-12-04 10:10:31 UTC | 4928 | IN | |
| 2024-12-04 10:10:31 UTC | 4845 | IN | |
| 2024-12-04 10:10:31 UTC | 1319 | IN | |
| 2024-12-04 10:10:31 UTC | 1390 | IN | |
| 2024-12-04 10:10:31 UTC | 1390 | IN | |
| 2024-12-04 10:10:31 UTC | 1390 | IN | |
| 2024-12-04 10:10:31 UTC | 1390 | IN | |
| 2024-12-04 10:10:31 UTC | 1390 | IN | |
| 2024-12-04 10:10:31 UTC | 1390 | IN | |
| 2024-12-04 10:10:31 UTC | 1390 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.5 | 49759 | 104.21.67.152 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:10:36 UTC | 85 | OUT | |
| 2024-12-04 10:10:37 UTC | 886 | IN | |
| 2024-12-04 10:10:37 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.5 | 49779 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:10:45 UTC | 296 | OUT | |
| 2024-12-04 10:10:45 UTC | 1090 | OUT | |
| 2024-12-04 10:10:46 UTC | 388 | IN | |
| 2024-12-04 10:10:46 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.5 | 49790 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:10:49 UTC | 296 | OUT | |
| 2024-12-04 10:10:49 UTC | 1090 | OUT | |
| 2024-12-04 10:10:50 UTC | 388 | IN | |
| 2024-12-04 10:10:50 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.5 | 49799 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:10:53 UTC | 272 | OUT | |
| 2024-12-04 10:10:53 UTC | 1090 | OUT | |
| 2024-12-04 10:10:54 UTC | 388 | IN | |
| 2024-12-04 10:10:54 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.5 | 49810 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:10:57 UTC | 272 | OUT | |
| 2024-12-04 10:10:57 UTC | 1090 | OUT | |
| 2024-12-04 10:10:57 UTC | 388 | IN | |
| 2024-12-04 10:10:57 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.5 | 49821 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:00 UTC | 272 | OUT | |
| 2024-12-04 10:11:00 UTC | 1090 | OUT | |
| 2024-12-04 10:11:01 UTC | 388 | IN | |
| 2024-12-04 10:11:01 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.5 | 49830 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:04 UTC | 272 | OUT | |
| 2024-12-04 10:11:04 UTC | 1090 | OUT | |
| 2024-12-04 10:11:05 UTC | 388 | IN | |
| 2024-12-04 10:11:05 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.5 | 49842 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:08 UTC | 272 | OUT | |
| 2024-12-04 10:11:08 UTC | 1090 | OUT | |
| 2024-12-04 10:11:08 UTC | 388 | IN | |
| 2024-12-04 10:11:08 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.5 | 49851 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:11 UTC | 272 | OUT | |
| 2024-12-04 10:11:11 UTC | 1090 | OUT | |
| 2024-12-04 10:11:12 UTC | 388 | IN | |
| 2024-12-04 10:11:12 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.5 | 49861 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:15 UTC | 272 | OUT | |
| 2024-12-04 10:11:15 UTC | 1090 | OUT | |
| 2024-12-04 10:11:16 UTC | 388 | IN | |
| 2024-12-04 10:11:16 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.5 | 49873 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:19 UTC | 272 | OUT | |
| 2024-12-04 10:11:19 UTC | 1090 | OUT | |
| 2024-12-04 10:11:20 UTC | 388 | IN | |
| 2024-12-04 10:11:20 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.5 | 49883 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:23 UTC | 272 | OUT | |
| 2024-12-04 10:11:23 UTC | 1090 | OUT | |
| 2024-12-04 10:11:23 UTC | 388 | IN | |
| 2024-12-04 10:11:23 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.5 | 49895 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:27 UTC | 272 | OUT | |
| 2024-12-04 10:11:27 UTC | 1090 | OUT | |
| 2024-12-04 10:11:28 UTC | 388 | IN | |
| 2024-12-04 10:11:28 UTC | 541 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.5 | 49909 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:32 UTC | 272 | OUT | |
| 2024-12-04 10:11:32 UTC | 1090 | OUT | |
| 2024-12-04 10:11:32 UTC | 388 | IN | |
| 2024-12-04 10:11:32 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.5 | 49918 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:35 UTC | 272 | OUT | |
| 2024-12-04 10:11:35 UTC | 1090 | OUT | |
| 2024-12-04 10:11:36 UTC | 388 | IN | |
| 2024-12-04 10:11:36 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.5 | 49929 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:39 UTC | 272 | OUT | |
| 2024-12-04 10:11:39 UTC | 1090 | OUT | |
| 2024-12-04 10:11:40 UTC | 388 | IN | |
| 2024-12-04 10:11:40 UTC | 543 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.5 | 49939 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:43 UTC | 296 | OUT | |
| 2024-12-04 10:11:43 UTC | 1090 | OUT | |
| 2024-12-04 10:11:44 UTC | 388 | IN | |
| 2024-12-04 10:11:44 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.5 | 49948 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:47 UTC | 296 | OUT | |
| 2024-12-04 10:11:47 UTC | 1090 | OUT | |
| 2024-12-04 10:11:48 UTC | 388 | IN | |
| 2024-12-04 10:11:48 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.5 | 49959 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:51 UTC | 296 | OUT | |
| 2024-12-04 10:11:51 UTC | 1090 | OUT | |
| 2024-12-04 10:11:51 UTC | 388 | IN | |
| 2024-12-04 10:11:51 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.5 | 49970 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:55 UTC | 296 | OUT | |
| 2024-12-04 10:11:55 UTC | 1090 | OUT | |
| 2024-12-04 10:11:55 UTC | 388 | IN | |
| 2024-12-04 10:11:55 UTC | 542 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.5 | 49980 | 149.154.167.220 | 443 | 7576 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-04 10:11:58 UTC | 272 | OUT | |
| 2024-12-04 10:11:58 UTC | 1090 | OUT | |
| 2024-12-04 10:11:59 UTC | 388 | IN | |
| 2024-12-04 10:11:59 UTC | 542 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 05:09:54 |
| Start date: | 04/12/2024 |
| Path: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 755'273 bytes |
| MD5 hash: | EB15BBEFE683EF09C1C5C1BF5068DD71 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 05:10:15 |
| Start date: | 04/12/2024 |
| Path: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 755'273 bytes |
| MD5 hash: | EB15BBEFE683EF09C1C5C1BF5068DD71 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 20.1% |
| Dynamic/Decrypted Code Coverage: | 15.2% |
| Signature Coverage: | 18.9% |
| Total number of Nodes: | 1510 |
| Total number of Limit Nodes: | 45 |
Graph
Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335stringfilecomCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216stringregistrylibraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004026F9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401718 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 12.4% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 2.6% |
| Total number of Nodes: | 234 |
| Total number of Limit Nodes: | 18 |
Graph
Function 356CB4C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55encryptionCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CBCB8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55encryptionCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 3675E600 Relevance: 2.0, Strings: 1, Instructions: 764COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E98D0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EF0F0 Relevance: 1.6, Strings: 1, Instructions: 306COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E6130 Relevance: .7, Instructions: 709COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CA928 Relevance: .3, Instructions: 296COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CF3F8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0015E6A8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0015EC58 Relevance: .2, Instructions: 229COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E77F0 Relevance: .2, Instructions: 219COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E7E40 Relevance: .2, Instructions: 219COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E8490 Relevance: .2, Instructions: 218COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E71A8 Relevance: .2, Instructions: 218COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E8481 Relevance: .2, Instructions: 204COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0015EFAF Relevance: .2, Instructions: 202COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E9568 Relevance: .2, Instructions: 196COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E6121 Relevance: .2, Instructions: 168COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E77E0 Relevance: .1, Instructions: 148COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E7E30 Relevance: .1, Instructions: 146COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 36750608 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EB028 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 3675C4BC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 3675E538 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EDED8 Relevance: 2.6, Strings: 2, Instructions: 108COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 36750849 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E9C55 Relevance: .3, Instructions: 322COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E9C53 Relevance: .3, Instructions: 319COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EE9B0 Relevance: .2, Instructions: 189COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E9FAF Relevance: .2, Instructions: 155COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E5400 Relevance: .1, Instructions: 147COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EA709 Relevance: .1, Instructions: 144COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EE968 Relevance: .1, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EAA39 Relevance: .1, Instructions: 95COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EAA48 Relevance: .1, Instructions: 88COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EEF71 Relevance: .1, Instructions: 87COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EE99F Relevance: .1, Instructions: 84COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E53F0 Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0009D4DC Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E9479 Relevance: .1, Instructions: 73COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000AD030 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0009D4D7 Relevance: .1, Instructions: 56COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E94A8 Relevance: .1, Instructions: 56COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 000AD02B Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EDAE4 Relevance: .0, Instructions: 50COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EA931 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EA940 Relevance: .0, Instructions: 39COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E70C8 Relevance: .0, Instructions: 39COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E70E8 Relevance: .0, Instructions: 35COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EAFB1 Relevance: .0, Instructions: 32COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EAB75 Relevance: .0, Instructions: 22COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EFF0E Relevance: .0, Instructions: 18COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E70B8 Relevance: .0, Instructions: 15COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E9828 Relevance: .0, Instructions: 13COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EAA10 Relevance: .0, Instructions: 13COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E6F94 Relevance: .0, Instructions: 12COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040335A Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E8AD8 Relevance: 23.0, Strings: 18, Instructions: 461COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405772 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E8AC9 Relevance: 12.9, Strings: 10, Instructions: 365COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E5631 Relevance: 1.9, Strings: 1, Instructions: 601COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E0D48 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E15F8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E3598 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E2CE8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E0498 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E4FA8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E3E48 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E46F8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E1EA8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E3140 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E39F0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E11A0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E0040 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E08F0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E2890 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E4B50 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E2300 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E1A50 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356E42A0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CBD78 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356C9370 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CEB48 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CD330 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356C97C8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CC1D0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CEFA0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CA078 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CF850 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CC628 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356C9C20 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CE6F0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CCED8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CA4D0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356CCA80 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EA6C7 Relevance: .0, Instructions: 17COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004038B4 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004042CC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004045CA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405F0C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 356EDEC0 Relevance: 5.1, Strings: 4, Instructions: 102COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|